Анализ сетевых потоков NetFlow и IPFIX

★ 8.4 · security

analyzing-network-flow-data-with-netflow is a Claude Code skill that parses NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. It uses the Python netflow library to decode flow records via `netflow.parse_packet()`, builds traffic baselines, and applies statistical analysis to flag flows with abnormal byte counts, connection durations, and periodic timing. A built-in collector can be started with `python -m netflow.collector -p 9995`, and findings are exported via `agent.py` to a prioritized JSON report. The skill is designed for SOC analysts and threat hunters investigating network incidents covered by MITRE ATT&CK techniques T1071, T1048, T1046, and T1095.