mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-19 14:09:40 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
44 lines
1.5 KiB
Markdown
44 lines
1.5 KiB
Markdown
---
|
|
name: analyzing-network-flow-data-with-netflow
|
|
description: >-
|
|
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data
|
|
exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow
|
|
records, builds traffic baselines, and applies statistical analysis to identify flows
|
|
with abnormal byte counts, connection durations, and periodic timing patterns.
|
|
domain: cybersecurity
|
|
subdomain: network-security
|
|
tags: [analyzing, network, flow, data]
|
|
version: "1.0"
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
---
|
|
|
|
|
|
# Analyzing Network Flow Data with Netflow
|
|
|
|
## Instructions
|
|
|
|
1. Install dependencies: `pip install netflow`
|
|
2. Collect NetFlow/IPFIX data from routers or use the built-in collector: `python -m netflow.collector -p 9995`
|
|
3. Parse captured flow data using `netflow.parse_packet()`.
|
|
4. Analyze flows for:
|
|
- Port scanning: single source to many destinations on same port
|
|
- Data exfiltration: high byte-count outbound flows to unusual destinations
|
|
- C2 beaconing: periodic connections with consistent intervals
|
|
- Volumetric anomalies: traffic spikes beyond baseline thresholds
|
|
5. Generate a prioritized findings report.
|
|
|
|
```bash
|
|
python scripts/agent.py --flow-file captured_flows.json --output netflow_report.json
|
|
```
|
|
|
|
## Examples
|
|
|
|
### Parse NetFlow v9 Packet
|
|
```python
|
|
import netflow
|
|
data, _ = netflow.parse_packet(raw_bytes, templates={})
|
|
for flow in data.flows:
|
|
print(flow.IPV4_SRC_ADDR, flow.IPV4_DST_ADDR, flow.IN_BYTES)
|
|
```
|