inspect

To extract security events from PCAP files, this Skill processes traffic using suricata-read to generate EVE JSON, extracting protocol metadata and alerts for incident investigation and threat hunting workflows.

Yes, you can analyze pre-existing Suricata EVE JSON logs for alert investigation. The Skill detects input by file extension and parses events by event_type to surface alerts, flows, and protocol activity.

You can optionally load custom Suricata rules during PCAP processing to generate alerts for testing and threat hunting, leveraging proactive rule usage alongside the suricata-read tooling.

Network traffic analysis requires Suricata tooling, specifically suricata-read, to process PCAP files and extract security events. The Skill supports container mode and emphasizes safe processing patterns.

The best way to triage protocol metadata from Suricata EVE logs is through metadata-driven analysis, categorizing extracted events by event_type to support structured threat hunting and incident response.

Yes, this PCAP processing approach applies to both incident investigations and threat hunting workflows, handling PCAP processing and pre-recorded EVE logs with optional Suricata rule loading for detections.