pcap-hunter is an AI-enhanced threat hunting workbench that turns raw packet captures into correlated findings, ATT&CK hypotheses, and evidence-grounded reports for authorized SOC and DFIR analysts.
| Tool | ninedter/pcap-hunter — AI-assisted threat-hunting workbench bridging manual packet analysis and automated monitoring |
| Category | Network forensics / SOC analysis platform (Python + React, MIT licensed) |
| Primary Use | Ingesting PCAP captures in authorized investigations, triaging IOCs against OSINT providers, and generating evidence-grounded threat reports |
| Safe Use | Intended for authorized SOC analysts, DFIR practitioners, and threat hunters working captures from their own environments, incident response engagements, or lab exercises; documentation privacy mode redacts sensitive values for safe sharing |
| Telemetry Note | Purely defensive analysis tool; it consumes captures locally and queries threat-intel APIs (VirusTotal, AbuseIPDB, GreyNoise, OTX, Shodan), so defenders should expect outbound enrichment lookups containing extracted indicators — worth noting on monitored egress networks |
Packet captures remain the most honest artifact in incident response, and also the most expensive to read. pcap-hunter, an MIT-licensed Python project from ninedter, attacks that cost problem directly: it is an AI-enhanced threat hunting workbench that sits between manual packet inspection in Wireshark and fully automated network monitoring. At its core it keeps the packet-analysis depth of Zeek, Tshark, and PyShark, then wraps them in an analyst-first React workbench with workspaces for analysis, dashboards, findings, traffic replay, ATT&CK mapping, threat intelligence, raw data, reports, and case management. The repository sits at 169 stars and the current release is version v3.1.0, requiring Python 3.11+.
The architecture described in the README is a two-tier split: a Python analysis engine that runs a durable ten-stage pipeline over uploaded captures, and a responsive React front-end served via Docker. This division matters operationally. The deterministic engine produces parsed flows, DNS records, TLS metadata including JA3/JA3S fingerprints, Zeek logs, carved payloads, and YARA match datasets — all with exact timestamps and capture lineage. The LLM layer is deliberately optional: if no model or enrichment provider is available, the deterministic evidence view still stands on its own. For a blue team that distrusts AI output, that design decision is the difference between a toy and a usable tool.
The LLM integration itself is unusually flexible. Under Settings → LLM & reports, analysts choose between three interchangeable backends: LM Studio for local, air-gapped-friendly generation with section-by-section reports sized for small context windows; OpenAI for a single-shot report over the full evidence corpus; and Anthropic via the official anthropic SDK with streaming. A configurable context budget of 10K–1M tokens applies a conservative 50% input ceiling, with an explicit unlimited mode for pushing all sanitized evidence at once. Reports are evidence-grounded rather than free-form narrative — the README promises severity-calibrated assessments, false-positive awareness, confidence qualifiers, a Risk Matrix rendered as a real Markdown table, and an IOC Summary. Nine report languages are supported, including Traditional Chinese, Japanese, Korean, and several European languages.
What elevates pcap-hunter above a pretty Zeek viewer is its scoring model. Indicators of compromise are ranked Critical, High, Medium, or Low through a three-tier signal architecture. Tier 1 covers definitive OSINT confirmations — a VirusTotal or GreyNoise malicious verdict — and any single Tier 1 hit sets a score floor. Tier 2 captures behavioral signals like C2 beaconing, flow asymmetry, DNS tunneling, and DGA domains. Tier 3 holds contextual signals such as AbuseIPDB reputation, self-signed or expired certificates, and YARA matches, which alone can never push an indicator above medium. The rule that corroboration across tiers is required for high or critical verdicts is a sensible guard against single-source false positives, and the Dashboard's Why this risk level? expander makes every verdict explainable — a feature reviewers and court-bound DFIR work both appreciate.
The correlation engine behind those composite scores uses a Bayesian independence-complement formula, 1 − Π(1 − wᵢsᵢ), rather than naive linear summation. The practical consequence is diminishing returns for repeated weak signals while still allowing multiple independent weak indicators to compound into something meaningful, and strong-signal floors prevent dilution when a confirmed detection rides alongside noise. This is the kind of design detail that tells you the author has actually had to defend a priority queue in a SOC, not just aggregate numbers for a dashboard.
Flow analysis includes data exfiltration detection based on suspicious outbound-to-inbound byte ratios per source/destination pair — the README cites a default 10:1 threshold — which is a classic heuristic for spotting staging or C2 channels hiding in ordinary-looking traffic. Alongside it, the Traffic workspace provides a chronological replay of retained packet samples with play, pause, step, and seek controls, filterable by IP, protocol, and time range, and it explicitly shows its sample and truncation limits rather than pretending to replay the whole capture. That honesty about coverage extends to the Dashboard, which distinguishes parsed flow totals from the original capture and the replay sample, and records capture-quality telemetry — packet and flow scale, parse coverage, time window, and detector visibility gaps — alongside findings.
The ATT&CK workspace deserves specific attention because of how it frames conclusions. Network observations are presented as ATT&CK hypotheses rather than proof of endpoint execution — the README is explicit about this epistemic boundary. Analysts review confidence levels, record dispositions, examine coverage gaps, link Detection Strategies and Data Components, and export Navigator layers for downstream use. This is the correct posture for network-only evidence, where a beaconing pattern suggests T1071-style command and control but cannot by itself demonstrate execution on the host. Junior analysts benefit from having that limitation enforced by the tool's vocabulary.
Threat-intelligence triage is provider-aware across VirusTotal, AbuseIPDB, GreyNoise, OTX, and Shodan, and the UI deliberately distinguishes a provider returning no data from a provider being unconfigured or unreachable — a subtle but important difference when an IOC's clean reputation might just mean nobody looked. IP and domain triage retains verdict, ASN, organization, score, enrichment state, and WHOIS access, and the Evidence workspace keeps the full indicator inventory — IPs, domains, hashes, fingerprints, source capture, and assessment — searchable and exportable in one place.
Case management rounds out the workflow: captures, analyses, IOCs, severity, status, tags, and analyst notes persist across sessions, so a long investigation survives analyst shift changes. The Reports workspace generates or refreshes the optional AI threat report, lets the analyst verify which deterministic evidence sources fed into it, downloads a PDF, and switches to structured export formats without re-running packet analysis — a small touch that saves real time on large captures. Stored secrets in Settings are write-only and encrypted at rest.
Two operational notes stand out for teams evaluating adoption. First, the documentation privacy mode is a genuinely thoughtful feature: an opt-in view irreversibly replaces addresses, hostnames, case details, capture filenames, secrets, and locations with labels like [IP 01] and [HOST 01] before screenshots are saved, making it safe to share UI examples in tickets, training, or blog posts. Second, enrichment lookups send extracted indicators to third-party APIs, so analysts working sensitive engagements should route those through appropriate accounts and be conscious that querying an IOC can itself signal interest — the local LM Studio backend mitigates the report-generation side of that concern entirely.
With MIT licensing, CI badges, an English user manual, a Traditional Chinese README, and an unusually detailed changelog discipline, pcap-hunter presents as a mature defensive project rather than a weekend script. For authorized SOC teams, DFIR consultants, and lab-based learners who live in PCAP files and want structured, explainable, evidence-grounded triage instead of endless manual tshark filters, it is well worth a git clone and a test capture.
ninedter/pcap-hunter.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.