← LeaderboardThe Skill Leaderboard

implementing-network-traffic-analysis-with-arkime

Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, download PCAPs, detect C2 beaconing through connection interval/jitter stats, spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate issuers, using the bundled scripts/agent.py. Use when investigating suspicious network flows or doing full-packet-capture forensics against an Arkime deployment.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

implementing-network-traffic-analysis-with-arkime

Start a fresh conversation. Replace the highlighted placeholders.

Use implementing-network-traffic-analysis-with-arkime to investigate suspicious flows in [authorized Arkime environment] within [written authorized scope], producing a forensic report on relevant sessions, beaconing, DNS tunneling, and TLS issuer indicators; use only the test or lab environment and authorized access.

Required inputs

  • [authorized Arkime environment]
  • [written authorized scope]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: implementing-network-traffic-analysis-with-arkimedescription: Queries Arkime (formerly Moloch) full packet capture via its API to search sessions,  download PCAPs, detect C2 beaconing through connection interval/jitter stats,  spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate  issuers, using the bundled scripts/agent.py. Use when investigating suspicious  network flows or doing full-packet-capture forensics against an Arkime deployment.domain: cybersecuritysubdomain: network-securitytags: - network-security- arkime- full-packet-capture- nta- pcap-analysis- network-forensicsversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.IR-01- DE.CM-01- ID.AM-03- PR.DS-02mitre_attack: - T1046- T1040- T1557- T1071- T1095

Implementing Network Traffic Analysis with Arkime

When to Use

  • When deploying or configuring implementing network traffic analysis with arkime capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Familiarity with network security concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install requests
  2. Configure Arkime viewer URL and credentials.
  3. Run the agent to query Arkime sessions and analyze traffic:
    • Search sessions by IP, port, protocol, or expression
    • Download PCAP data for forensic analysis
    • Detect C2 beaconing via connection interval analysis
    • Identify DNS tunneling through query length statistics
    • Flag connections to known-bad TLS certificate issuers
python scripts/agent.py --arkime-url https://arkime.local:8005 --user admin --password secret --output arkime_report.json

Examples

Beaconing Detection

Source: 10.1.2.50 -> 185.220.101.34:443
Sessions: 288 over 24 hours
Avg interval: 300s, Jitter: 4.2%
Verdict: HIGH confidence C2 beaconing (jitter < 5%)