suricata-analyze

Plugin suricata-analyze from marketplace stamus-ai-tools in StamusNetworks/stamus-ai-tools. Commands read from the repo's manifest — 1 month ago.

Skills (6)

• hunt-dns-tunnel

  Hunt for DNS tunneling in Suricata eve.json. Detects two archetypes - (1) TXT base64 file exfiltration with sequential chunked payloads, (2) dnscat2-style C2 with hex-encoded QNAME subdomain labels and multi-type channel rotation (MX/TXT/CNAME). Reconstructs and decodes exfiltrated payloads or extra

• hunt-generic

  Generic highlevel threat hunt in network traffic from PCAP files or Suricata EVE JSON logs

• hunt-smb-dcerpc

  Hunt for malicious SMB / DCERPC activity in Suricata eve.json. Starts from event_type:flow where app_proto is smb or dcerpc and pivots on flow.tx_cnt (high counts = automated abuse), then correlates each flow_id to event_type:smb and event_type:dcerpc records for status codes and RPC interfaces. Det

• hunt-tls-c2

  Hunt for malicious TLS in Suricata eve.json (event_type:tls). Detects DGA / high-entropy / word-list SNI, IP-literal and malformed SNI, high-abuse TLDs (.xyz/.cc/.cyou/.sbs/.cfd/.top/.online/.icu/etc.), IP-literal and invalid cert Subject/Issuer CN, self-signed and OpenSSL-default certificates (subj

• hunt

  Hunt for threats and suspicious activity in network traffic from PCAP files or Suricata EVE JSON logs

• inspect

  Inspect network traffic from PCAP files or Suricata EVE JSON logs to extract security events, alerts, and protocol metadata