CapMe

weslambert edited this page Apr 19, 2018 · 10 revisions
Clone this wiki locally

Description

CapME is a web interface that allows you to:

  • view a pcap transcript rendered with tcpflow
  • view a pcap transcript rendered with Bro (especially helpful for dealing with gzip encoding)
  • download a pcap

Accessing

You can pivot to CapME from a NIDS alert in Squert or from any log in Kibana that has timestamp, source IP, source port, destination IP, and destination port.

Logging In

When prompted for username/password, simply enter your normal Sguil/Squert/Kibana username/password.