Menu
Normalize DNS input from PCAP or CSV into one unified JSON dataset.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Merge Stage 2 DNS analysis scores and calculate final exfiltration verdicts.
Capture live DNS queries with tcpdump for a configurable duration, save the traffic to a PCAP file, and process it through the existing PCAP reader. Use when a user explicitly requests timed live DNS capture from a network interface.
Compute DGA probabilities using a pre-trained RandomForest model.
Score DNS queries for anomalies using the trained embedding similarity model.
Calculate DNS subdomain entropy scores for exfiltration and DGA detection.
Generate a Markdown security report from aggregated DNS exfiltration scores.
| name | dns-extractor |
| description | Normalize DNS input from PCAP or CSV into one unified JSON dataset. |
Normalize DNS input from two sources into one unified JSON dataset.
Source A: decode raw DNS payloads from pcap_reader_agent output.
Source B: read CSV directly from the Kaggle dns-tunneling dataset.
Output is consumed by all three Stage-2 analysis agents.
extract_dns_queries(packets: list[dict] = None, csv_path: str = None) -> list[dict]
pcap_reader_agent produces raw_packets.json.data/input/dns_tunneling.csv is the input source.| Parameter | Type | Required | Description |
|---|---|---|---|
packets | list[dict] | no* | Output list from read_pcap_file |
csv_path | str | no* | Path to Kaggle CSV file |
*At least one of packets or csv_path must be provided.
Returns a list of dicts written to data/output/dns_queries.json.
Every item contains exactly these fields:
| Field | Type | Description |
|---|---|---|
query_id | integer | Sequential ID starting at 1 |
timestamp | float | Unix epoch (0.0 for CSV rows) |
src_ip | string | Source IP ("0.0.0.0" for CSV rows) |
domain | string | Full domain, lowercase, no trailing dot |
query_type | string | "A", "AAAA", "TXT", "CNAME", "MX", etc. |
subdomain | string | Everything left of the registered domain (may be "") |
tld | string | Top-level domain, e.g. "com", "net" |
label_count | integer | Number of DNS labels in the full domain |
domain_length | integer | Total character length of the full domain |
digit_ratio | float | Ratio of digit characters in subdomain (0.0 if empty) |
label | string | "benign", "malicious", or "unknown" |
count | integer | Repeat frequency of this (domain, src_ip) pair |
source | string | "pcap" or "csv" |
scapy>=2.5.0
tldextract>=3.4.0
pandas>=2.0.0
from tools.pcap_reader import read_pcap_file
from tools.dns_extractor import extract_dns_queries
# PCAP mode
packets = read_pcap_file("data/input/demo.pcap")
queries = extract_dns_queries(packets=packets)
# CSV mode
queries = extract_dns_queries(csv_path="data/input/dns_tunneling.csv")
# Both merged
queries = extract_dns_queries(packets=packets,
csv_path="data/input/dns_tunneling.csv")
print(f"Extracted {len(queries)} DNS queries")
TLDExtract(suffix_list_urls=None) for deterministic,
offline Public Suffix List behavior.timestamp, src_ip, query_type are set to defaults
(0.0, "0.0.0.0", "A") since the dataset does not include them.data/output/dns_queries.json.