network-traffic-forensics
Professional network forensics and packet analysis for incident response and security investigations.
- Reconstruct network events from PCAP evidence during a security incident.
- Extract and document IoCs from suspicious DNS and HTTP traffic logs.
- Generate structured forensic reports for executive and technical stakeholders.
Secure checkout via Stripe
Included in download
- Reconstruct network events from PCAP evidence during a security incident.
- Extract and document IoCs from suspicious DNS and HTTP traffic logs.
- terminal automation included
- Ready for including Claude Code
Sample Output
A real example of what this skill produces.
The skill produces a structured forensic report covering scope and evidence basis, capture metadata and integrity notes, key observations from DNS and conversation analysis, a suspicious communications table, an indicator of compromise register with source, timestamp, and confidence rating, a timeline of material events, and recommended validation actions. Evidence gaps such as encrypted traffic, truncated capture windows, or missing corroborating logs are explicitly noted rather than estimated around.
network-traffic-forensics
Professional network forensics and packet analysis for incident response and security investigations.
Secure checkout via Stripe
Included in download
- Reconstruct network events from PCAP evidence during a security incident.
- Extract and document IoCs from suspicious DNS and HTTP traffic logs.
- terminal automation included
- Ready for including Claude Code
- Instant install
Sample Output
A real example of what this skill produces.
The skill produces a structured forensic report covering scope and evidence basis, capture metadata and integrity notes, key observations from DNS and conversation analysis, a suspicious communications table, an indicator of compromise register with source, timestamp, and confidence rating, a timeline of material events, and recommended validation actions. Evidence gaps such as encrypted traffic, truncated capture windows, or missing corroborating logs are explicitly noted rather than estimated around.
About This Skill
What it does
This skill enables AI agents to perform professional-grade network traffic forensics and incident analysis. It processes packet captures (PCAP), flow records, and tool outputs (like tshark, Zeek, or Wireshark) to reconstruct security incidents, identify suspicious communications, and document findings in a structured forensic report.
Why use this skill
Manual network analysis is time-consuming and prone to oversight. This skill provides a structured methodology for forensic investigations, ensuring that indicators of compromise (IoCs), lateral movement, and exfiltration attempts are systematically identified. Unlike generic AI prompting, this skill enforces forensic rigor, maintaining a chain of custody, distinguishing between facts and hypotheses, and highlighting evidence gaps.
Supported analysis types
- Traffic Reconstruction: Beaconing detection, lateral movement mapping, and protocol misuse.
- Metadata Analysis: Deep dives into DNS queries, HTTP headers, TLS SNI, and certificate chains.
- Forensic Reporting: Generation of executive summaries, IoC tables, and chronological timelines.
- Validation: Alignment of network evidence with endpoint logs and threat intelligence.
The Output
The skill produces a detailed forensic dossier including an evidence inventory, an analyst-grade timeline of events, a categorized list of IoCs, and concrete validation actions for incident response teams.
Use Cases
- Reconstruct network events from PCAP evidence during a security incident.
- Extract and document IoCs from suspicious DNS and HTTP traffic logs.
- Generate structured forensic reports for executive and technical stakeholders.
- Identify lateral movement and Command & Control (C2) beaconing patterns.
- Validate suspected data exfiltration using flow records and packet metadata.
How to Install
mkdir -p ~/.claude/skills && curl -sL https://www.agensi.io/api/install/network-traffic-forensics | tar xz -C ~/.claude/skills/Free skills install directly. Paid skills require purchase - use the download button above after buying.
Reviews
No reviews yet - be the first to share your experience.
Only users who have downloaded or purchased this skill can leave a review.
Early access skill
Be the first to review this skill.
Only users who have downloaded or purchased this skill can leave a review.
Security Scanned
Passed automated security review
Permissions
Works with any agent that supports the Universal SKILL.md standard, including Claude Code, Codex CLI, Cursor, VS Code Copilot, Gemini CLI, OpenClaw, and 20+ compatible agents.