Network

dns_resolve

Cause the sensor to do a network resolution.
Mainly used for internal purposes.

Platforms: Windows, Linux, MacOS, Chrome

usage: dns_resolve [-h] domain

positional arguments:
  domain      domain name to resolve

netstat

List network connections and sockets listening.

Platforms:

usage: netstat [-h]

Output:

{
  "FRIENDLY": 0,
  "NETWORK_ACTIVITY": [
    {
      "DESTINATION": {
        "IP_ADDRESS": "0.0.0.0",
        "PORT": 0
      },
      "PROCESS_ID": 716,
      "PROTOCOL": "tcp4",
      "SOURCE": {
        "IP_ADDRESS": "0.0.0.0",
        "PORT": 135
      },
      "STATE": 2
    },
    {
      ...
    }
  ]
}

Netstat STATE fields can be mapped via the Windows MIB_TCP_STATE table, found here.

pcap_ifaces

List the network interfaces available for capture on a host.