What types of network logs and data formats are supported?

The skill is optimized for Zeek (Bro) logs, NetFlow data, and standard CSV/TSV exports from firewalls or proxies. It uses a flexible alias matching system to ensure compatibility with most enterprise log formats.

Why is this skill better than just asking an AI agent to look for threats in a log file?

Unlike generic LLM prompts that struggle with statistical math, this skill uses deterministic Python scripts to calculate jitter and entropy scores. This ensures you identify mathematically verified beacons rather than hallucinated patterns.

What exactly is included in the purchase of this skill?

The package includes the core threat-hunting logic, pre-configured scoring scripts for beaconing and DGA detection, and a mapping guide for aligning findings to the MITRE ATT&CK framework.

Are there any limitations on the volume of network data the skill can analyze at once?

For massive datasets, we recommend pre-filtering logs by specific timeframes or protocols to ensure optimal performance within the agent's compute limits. The skill is designed to handle standard hunt tasks but may require chunking for multi-gigabyte files.

Does the skill provide a prioritized list of threats, or just a raw analysis?

Yes, the skill provides a ranked list of findings sorted by threat score, specifically highlighting high-regularity beacons and high-entropy DNS queries that indicate active tunneling.

Network Threat Hunter

Example session with this skill installed

Analyze this Zeek conn.log for any signs of beaconing or C2 activity. Highlight the top 5 suspicious destinations based on regularity.

Read your context and instructions
Compiled the network threat hunter

I have processed the provided Zeek conn.log file. The analysis calculated interval regularity, payload size consistency, and connection volume to identify potential C2 beacons.

Network Threat Analysis Results

Source IP	Destination IP	Dest Port	Conn Count	Regularity Score	Size Score	Findings
192.168.1.45	91.228.167.21	443	842	0.942	0.981	High-confidence beacon; consistent 60s interval.
192.168.1.12	104.26.10.233	443	1204	0.895	0.412	Periodic heartbeat; payload size varies significantly.
192.168.1.45	185.199.110.153	80	45	0.821	0.884	Periodic check-in; potential T1071 mapping.
172.16.0.5	52.114.32.12	443	2150	0.710	0.120	Noisy regularity; likely legitimate telemetry.
192.168.1.102	203.0.113.5	53	540	0.680	0.950	Potential DNS tunneling; check dns.log for entropy.

Analysis Summary
The destination 91.228.167.21 shows a near-perfect regularity score (0.942) with extremely low jitter. This behavior is highly characteristic of a Cobalt Strike or similar C2 agent configured with a 60-second sleep and 0% jitter. The connection at 185.199.110.153 also warrants investigation due to the combination of interval and size regularity.

Next steps

Run scripts/beacon_hunt.py --pair 192.168.1.45,91.228.167.21,443 to extract raw timestamps for visualization.
Cross-reference 91.228.167.21 against EDR logs to identify the specific process initiating these calls.
Check threat intelligence feeds for the destination IP to confirm known C2 infrastructure.

Connects securely to your tools. The creator never sees your data.

About this skill

Security logs are noisy, making it nearly impossible to spot a single command-and-control beacon or DNS tunnel manually. This skill analyzes raw network telemetry to identify stealthy outbound threats that bypass traditional signature-based detection.

What it does

Beacon detection identifies periodic connections by calculating interval regularity and jitter scores.
DNS tunneling analysis flags high-entropy labels, long query names, and unusual subdomain cardinality.
Exfiltration tracking surfaces high-volume outbound transfers and long-lived persistent sessions.
DGA identification detects algorithmically generated domains using consonant-to-vowel ratios and length analysis.
Log normalization processes Zeek (TSV/JSON), NetFlow, firewall, and proxy exports via CSV alias matching.

How it works

Ingest telemetry by providing a conn.log, dns.log, or a CSV export from your firewall or proxy.
Execute hunt scripts to score connection pairs based on interval and payload size consistency.
Review findings sorted by threat score, focusing on high-regularity beacons and DGA-like domains.
Map to ATT&CK to classify findings under techniques like T1071 (C2) or T1048 (Exfiltration).

Frameworks & tools

This tool uses Python for statistical analysis (RITA-style scoring). It supports Zeek (Bro) logs, NetFlow data, and generic CSV/TSV exports from enterprise firewalls.

Why this beats prompting it yourself

Writing prompts to find beacons often fails because LLMs struggle with the high-cardinality math required for jitter and coefficient of variation. This skill uses deterministic Python scripts to calculate regularity scores, ensuring you find actual periodic patterns rather than just guessing.

Use cases

Threat hunting to find stealthy C2 channels in historic Zeek connection logs.
Incident response to quickly identify the scope of data exfiltration after a breach.
Compromise assessment to scan for DNS tunneling or DGA activity on a new network.

Known limitations

Large log files may require pre-filtering or chunking. Performance depends on the compute resources available to the agent environment.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

30-day refund

Not a fit? Get your money back

Network Threat Hunter