Network Traffic Incident Analysis
Guides an agent through analysing packet captures and flow logs to spot command-and-control, lateral movement and exfiltration.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, this skill gives the agent a structured playbook for investigating network evidence from a security incident. It explains how to capture or obtain traffic (tcpdump, Zeek logs, NetFlow), then how to look for beaconing to attacker servers, lateral movement over ports like SMB, RDP and WinRM, and data theft such as large uploads or DNS tunnelling, and how to pull out indicators and write up findings. A bundled Python script wraps tshark and scapy to automate some of these checks on a PCAP file.
Great for
- Security analysts or incident responders investigating a suspected breach using packet captures
- Students learning network forensics who want a worked checklist of Wireshark and Zeek filters
- Teams with Zeek or Wireshark already deployed who want a consistent investigation workflow
Skip it if
- Host-based investigations such as process execution or file system artifacts, which the skill itself says require endpoint tools
- Live production networks without authorisation: capturing traffic can expose private data and may be unlawful without approval
- Non-security users wanting general network troubleshooting; the content is aimed at incident response
Try asking
- “Analyse this PCAP for signs of C2 beaconing to external IPs and list the destinations”
- “Check this Zeek conn.log for large outbound transfers that could indicate data exfiltration”
- “Look through this capture for SMB, RDP or WinRM connections spreading from host 10.1.5.42”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-network-traffic-for-incidents.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-network-traffic-for-incidents.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-network-traffic-for-incidents.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the analysis on copies of captures, never on the only evidence copy, and record hashes for chain of custody
- Give the agent the time window and known suspect IPs so filters stay narrow and results are easier to verify
- Treat beaconing and DNS tunnelling findings as leads to confirm with threat intelligence rather than proof of compromise
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.