wireshark_security_audit
Analyze a pcap file with eight automated phases to detect threats, credential exposure, port scans, and protocol anomalies, producing a structured security report with risk scoring.
Instructions
[Agent] One-call comprehensive security audit.
Automatically runs 8 analysis phases internally and returns a structured security report with risk scoring. No manual tool-chaining needed.
Phases: File summary → Protocol overview → Threat intelligence (URLhaus) → Credential exposure → Port scan detection → DNS anomaly detection → Cleartext protocol usage → Protocol anomalies (Expert Info)
Args: pcap_file: Path to capture file
Returns: Complete security audit report with risk level, findings, and recommendations.
Example: wireshark_security_audit("suspicious_traffic.pcap")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pcap_file | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |