Network Traffic Forensics

What it does

This skill enables AI agents to perform professional-grade network traffic forensics and incident analysis. It processes packet captures (PCAP), flow records, and tool outputs (like tshark, Zeek, or Wireshark) to reconstruct security incidents, identify suspicious communications, and document findings in a structured forensic report.

Why use this skill

Manual network analysis is time-consuming and prone to oversight. This skill provides a structured methodology for forensic investigations, ensuring that indicators of compromise (IoCs), lateral movement, and exfiltration attempts are systematically identified. Unlike generic AI prompting, this skill enforces forensic rigor, maintaining a chain of custody, distinguishing between facts and hypotheses, and highlighting evidence gaps.

Supported analysis types

• Traffic Reconstruction: Beaconing detection, lateral movement mapping, and protocol misuse.
• Metadata Analysis: Deep dives into DNS queries, HTTP headers, TLS SNI, and certificate chains.
• Forensic Reporting: Generation of executive summaries, IoC tables, and chronological timelines.
• Validation: Alignment of network evidence with endpoint logs and threat intelligence.

The Output

The skill produces a detailed forensic dossier including an evidence inventory, an analyst-grade timeline of events, a categorized list of IoCs, and concrete validation actions for incident response teams.