skills.rest
automateyournetwork
automateyournetworkCOMMUNITY
Explore all skills by this author →
Website𝕏@john_capobiancoGitHub

network-data-analysis

Runs read-only SQL queries over Zeek logs and Suricata alerts using DuckDB.

650|182|Updated Feb 19, 2026
Search Tags:#sql#duckdb#packet capture#suricata#zeek#network forensics#Log Analysis
One-click install
npx skills add https://github.com/automateyournetwork/netclaw --skill network-data-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: network-data-analysis
Source: https://github.com/automateyournetwork/netclaw/tree/main/workspace/skills/network-data-analysis
Command: npx skills add https://github.com/automateyournetwork/netclaw --skill network-data-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Answering aggregate questions across a packet capture — top talkers, service counts, alert frequencies — is impractical when reading Zeek logs or Suricata eve.json line by line. This Skill loads exported network security data into a sandboxed DuckDB engine so you can run SQL aggregations, joins, and counts across an entire capture.

Core Features & Use Cases

  • SQL over Zeek logs: Query conn, http, and other Zeek tables with their real column names, joining on uid to pivot across sessions.
  • Suricata alert aggregation: Group and count IDS alert signatures from eve.json to see which detections fired most often.
  • Locked read-only sandbox: DuckDB runs with external access disabled and configuration locked, so queries can never reach memory stores, credentials, or arbitrary files.
  • Use Case: After running a packet capture analysis, ask which hosts generated the most connections and which Suricata signatures fired, then join HTTP requests to connection metadata to reconstruct suspicious sessions.

Quick Start

Ask the agent to show the top 20 talkers by connection count from the latest Zeek capture run.

Frequently Asked Questions about network-data-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze Zeek logs with SQL?▼

Load Zeek logs into DuckDB through the analysis tools, then query tables using their real column names like id_orig_h and id_resp_p. Join tables on the shared uid field to pivot across sessions within a capture run.

How to aggregate Suricata alerts from eve.json?▼

Query the Suricata eve table filtering on event_type equals alert, then use json_extract_string on the alert field to group by signature and count frequencies. This reveals which IDS detections fired most often across the capture.

Can DuckDB queries access files outside the allowed directories?▼

No. Datasets load only from allowlisted roots, then DuckDB external access is disabled and configuration locked irreversibly. Attempts to read arbitrary paths, attach other databases, or export data all fail.

Why does my query result show truncated true?▼

A truncated flag means the result hit the row cap and you are seeing only a page of the full output. Run a COUNT query to get the real total, and check analysis_status for dataset load caps before claiming completeness.

What are the limitations of SQL analysis over packet captures?▼

Queries are read-only, single-statement, and time out after 30 seconds. Results only reflect loaded data, so skipped oversized files or incomplete Zeek runs from the source capture can make aggregations misleading.

Related Skills

Explore More Data & Analytics Skills→
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced
Zidane786Zidane786

query-writing

Translate business questions into SQL queries with filters and aggregations.

Community
Intermediate
automateyournetworkautomateyournetwork
627

packet-analysis

Analyze network packet captures with Packet Buddy MCP and tshark.

Community
Intermediate
lugassawanlugassawan
2

workflow-grill

Resolve ambiguous requirements via prioritized decision trees with repository evidence.

Community
Intermediate