Network Security & Traffic Analysis

What problem does it solve?

This Skill helps security analysts turn raw network captures and firewall rules into actionable findings, reducing the time spent hunting for suspicious traffic patterns, covert channels, and misconfigurations.

Core Features & Use Cases

• PCAP Analysis: Summarize protocols, top talkers, DNS activity, beaconing behavior, and port scans from packet captures.
• Detection Engineering: Draft Suricata, Snort 3, and Zeek logic for C2, tunneling, exfiltration, and lateral movement patterns.
• Firewall Review: Audit iptables and cloud security group rules for dangerous exposure and weak default-deny posture.
• Use Case: You receive a PCAP from a suspected incident and want a clear breakdown of traffic anomalies plus candidate detection rules to investigate further.

Quick Start

Use the network security skill to analyze the attached PCAP file and produce a concise summary of suspicious flows, DNS anomalies, and recommended detections.