implementing-network-traffic-analysis-with-arkime

name	implementing-network-traffic-analysis-with-arkime
description	Queries Arkime (formerly Moloch) full packet capture via its API to search sessions, download PCAPs, detect C2 beaconing through connection interval/jitter stats, spot DNS tunneling via query-length analysis, and flag known-bad TLS certificate issuers, using the bundled scripts/agent.py. Use when investigating suspicious network flows or doing full-packet-capture forensics against an Arkime deployment.
domain	cybersecurity
subdomain	network-security
tags	["network-security","arkime","full-packet-capture","nta","pcap-analysis","network-forensics"]
version	1.0
author	mahipal
license