mcpField
I
implementing-network-traffic-analysis-with-arkime

implementing-network-traffic-analysis-with-arkime

github.com/mukul975Security35.2k49 installsUpdated 8w ago
Repository

About implementing-network-traffic-analysis-with-arkime

A skill for deploying or configuring network traffic analysis with Arkime. It describes session searches, PCAP downloads, beacon and DNS tunneling analysis, and report generation.

Key features

  1. 01Search sessions by IP, port, protocol, or expression
  2. 02Download PCAP for forensic analysis
  3. 03Detect C2 beaconing from connection intervals
  4. 04Identify DNS tunneling from query lengths
  5. 05Flag connections to suspect TLS certificate issuers

Use cases

  1. 01Investigate network sessions in Arkime
  2. 02Analyze PCAP data for forensics
  3. 03Hunt for suspected C2 beaconing or DNS tunnels

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill implementing-network-traffic-analysis-with-arkime

After installing, type/implementing-network-traffic-analysis-with-arkimein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Implementing Network Traffic Analysis with Arkime

When to Use

  • When deploying or configuring implementing network traffic analysis with arkime capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Familiarity with network security concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install requests
  2. Configure Arkime viewer URL and credentials.
  3. Run the agent to query Arkime sessions and analyze traffic:
    • Search sessions by IP, port, protocol, or expression
    • Download PCAP data for forensic analysis
    • Detect C2 beaconing via connection interval analysis
    • Identify DNS tunneling through query length statistics
    • Flag connections to known-bad TLS certificate issuers
python scripts/agent.py --arkime-url https://arkime.local:8005 --user admin --password secret --output arkime_report.json

Examples

Beaconing Detection
Source: 10.1.2.50 -> 185.220.101.34:443
Sessions: 288 over 24 hours
Avg interval: 300s, Jitter: 4.2%
Verdict: HIGH confidence C2 beaconing (jitter < 5%)

Comments

Markdown supported