Анализ сетевого трафика при инцидентах безопасности

★ 8.4 · security

analyzing-network-traffic-for-incidents is a Claude Code skill that analyzes packet captures and network flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. It applies Wireshark display filters, Zeek log queries across conn.log, dns.log, http.log, and ssl.log, and NetFlow analysis to detect beaconing patterns, DNS tunneling, large outbound transfers, and protocol abuse. The skill maps findings to MITRE ATT&CK techniques T1071, T1095, T1572, and T1573. SOC analysts and incident responders use it to validate IDS/IPS alerts at the packet level, trace lateral movement between internal hosts, and quantify data exfiltration volume from network evidence rather than host-based artifacts.