Example: pcap

• Inputs
• Profile
• Report outputs
  • Triage report (converted from triage_report.json)
  • CSV outputs
    • errors.csv
    • files.csv
    • pattern_matches.csv
    • signature_matches.csv
    • unique_files.csv

Inputs

• examples/inputs/pcap-samples/README.md
• examples/inputs/pcap-samples/sample_network.pcap

Profile

# PCAP Network Capture Analysis Example
# This demonstrates parsing network packet capture (PCAP) files
# The sample_network.pcap file contains a minimal valid PCAP structure with one packet

decode = []

tag = "pcap"

# PCAP file header pattern (magic bytes)
[[patterns]]
  name = "PCAP Magic (LE)"
  pattern = "D4:C3:B2:A1"
  type = "bytes"

[[patterns]]
  name = "PCAP Magic (BE)"
  pattern = "A1:B2:C3:D4"
  type = "bytes"

[[patterns]]
  name = "PCAP-NG Magic"
  pattern = "0A:0D:0D:0A"
  type = "bytes"

# Network protocol patterns
[[patterns]]
  name = "Ethernet Frame"
  pattern = "08:00"
  type = "bytes"

[[patterns]]
  name = "IPv4 Packet"
  pattern = "45:00"
  type = "bytes"

# DNS traffic patterns
[[patterns]]
  name = "DNS Query Port"
  pattern = "00:35"
  type = "bytes"

[[patterns]]
  name = "DNS Response Port"
  pattern = "00:35"
  type = "bytes"

# Common suspicious patterns in network traffic
[[patterns]]
  name = "Private IP Range 192.168"
  pattern = "192\\.168\\."
  type = "regex"

[[patterns]]
  name = "Private IP Range 10."
  pattern = "10\\."
  type = "regex"

# HTTP patterns
[[patterns]]
  name = "HTTP GET"
  pattern = "GET "
  type = "string"

[[patterns]]
  name = "HTTP POST"
  pattern = "POST "
  type = "string"

[[patterns]]
  name = "HTTP User-Agent"
  pattern = "User-Agent:"
  type = "string"
  case-insensitive = true

# Potential malicious patterns
[[patterns]]
  name = "Suspicious User-Agent"
  pattern = "curl|wget|python|powershell"
  type = "regex"
  case-insensitive = true

[[patterns]]
  name = "Port Scan Pattern"
  pattern = "SYN|RST|FIN"
  type = "string"

Report outputs

Triage report (converted from triage_report.json)

top_scores

CSV outputs

errors.csv

Empty CSV

files.csv

pattern_matches.csv

signature_matches.csv

Empty CSV

unique_files.csv