drop pcap pcapng or zeek conn log or windows netstat output · build a chronological connection timeline · reconstruct what connected where and when · surface connection bursts gaps and suspicious temporal patterns · runs locally
inputs
drop capture or log files
or click
drop pcap · pcapng · zeek conn.log · netstat · csv