Incident Response Networkv1.0.0

A bank detects suspicious lateral movement from a compromised employee workstation. Network engineers use this skill to collect ARP and CAM tables, start packet captures on critical segments, and verify that newly applied ACLs are blocking the attacker's traffic.

After a ransomware attack, a hospital's network team reconstructs the timeline of data exfiltration by analyzing flow records and routing table snapshots captured during and after the incident. The skill guides evidence preservation and timeline reconstruction for regulatory compliance.

A SaaS provider suspects an insider exfiltrating customer data via SSH tunnels. Using flow record analysis and packet captures on edge routers, the incident response team quantifies the volume of outbound data and identifies the specific hosts involved.

A large retailer's security team observes anomalous internal connections during peak shopping season. The skill's step-by-step procedure helps them trace the attacker's movement across VLANs using ARP/MAC changes and routing table analysis, minimizing disruption to sales operations.

Offer this skill as a retainer-based service to enterprises that lack in-house network forensics expertise. Customers pay a monthly fee for access to read-only network evidence collection and analysis during incidents.

Develop and sell online courses or workshops that teach network forensics using this skill. Generate revenue from course fees and certification exams for network security professionals.

License the skill as a plugin for commercial SIEM or SOAR products, enabling automated evidence collection playbooks. Revenue comes from licensing fees per deployment or per-incident usage.