net-incident-correlation

Correlate incident timing with network telemetry to reveal evidence.

Updated Mar 11, 2026

Search Tags:#analytics #telemetry #network #incident #correlation #incident-response #syslog

Ready to run

npx skills add https://github.com/ekkus93/vscode_skills --skill net-incident-correlation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: net-incident-correlation
Source: https://github.com/ekkus93/vscode_skills/tree/main/skills/net-incident-correlation
Command: npx skills add https://github.com/ekkus93/vscode_skills --skill net-incident-correlation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nettools-core.

What problem does it solve?

Correlate incident timing with network telemetry to reveal evidence that guides remediation and root-cause analysis.

Core Features & Use Cases

Evidence-driven correlation across incident windows with recent syslog-style events and configuration changes.
Scope-aware analysis supporting site, AP, client, and other selectors to focus investigations.
Actionable findings and recommended follow-up skills to accelerate incident response.

Quick Start

Provide an incident window and run the skill to produce ranked correlated evidence.

Frequently Asked Questions about net-incident-correlation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I correlate network telemetry with incident timing for root-cause analysis?▼

Incident correlation matches incident timing against network telemetry to reveal evidence for root-cause analysis. It analyzes syslog-style events and configuration changes within a defined time window to guide remediation.

Can I scope network incident correlation to a specific site or client device?▼

Network incident correlation supports scope-aware analysis using site, AP, and client selectors. This focuses the investigation on specific devices or locations within the defined incident window.

What data sources do I need to correlate incidents with network events?▼

Correlating incidents with network events requires configured event and change data sources, specifically syslog-style logs. The skill uses these inputs alongside the NETTOOLS helper and Python 3 to output a structured SkillResult.

How does incident correlation handle configuration changes during an incident window?▼

Incident correlation analyzes configuration changes occurring within the defined incident window alongside syslog events. This evidence-driven approach produces ranked findings to accelerate incident response.

Do I need the nettools-core dependency to run network incident correlation?▼

Network incident correlation requires the nettools-core dependency to function. The skill uses this NETTOOLS helper alongside Python 3 to process telemetry and output structured correlation results.

What is the best way to find evidence of network changes during a security incident?▼

Correlating incident timing with network telemetry is the best way to find evidence of changes during a security incident. The skill ranks correlated syslog events and configuration changes to reveal actionable findings.