PCAPCase v1.1.0: The Threat Intel Era

🔍 What's New

• 📊 Interactive HTML Reports: The --html output now generates a modern, interactive dashboard. Includes a sidebar navigation, protocol distribution donut chart, top active hosts bar chart, and a canvas-based network connections graph.
• 🛡️ VirusTotal YARA Sync: New pcapcase vt-sync command pulls the latest Enterprise YARA rules directly from VirusTotal to your local machine for air-gapped scanning.
• 🥷 MITRE ATT&CK Mappings: Findings now automatically render mapped MITRE ATT&CK techniques (e.g., T1046, T1018, T1041, T1105) directly inside the report.md and report.html tables.
• 🔒 Strict Offline-by-Design: VT integration strictly pulls rules. Zero PCAP data, hashes, or IPs are uploaded. Analysis remains 100% local and safe for confidential incident response.
• 🏥 Smart Dependency Checks: pcapcase doctor now gracefully detects missing or outdated TShark installations, providing OS-specific manual installation commands without performing risky auto-installs.

⚙️ Setup

To use the new VirusTotal YARA Sync feature, grab your API key from VirusTotal and set it as an environment variable (never hardcoded):

export VT_API_KEY="your_api_key_here"
pcapcase vt-sync --yara-limit 50