Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →automateyournetwork/nsm-ids-triage
Triage Suricata IDS alerts from a packet capture (read-only) — signature alerts with detection posture, severity filtering, and corroboration against Zeek session metadata.
Passed 15 of 18 test cases with the skill, and 11 of 18 without it.
and 4 more in the full report
5 fixed13 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
When examining alerts generated from `/captures/dmz.pcap`, what filtering parameter should be applied first to focus on actionable items before reviewing the unfiltered list?
| Checked | Without skill | With skill |
|---|---|---|
| Sets min_severity to 2 on the initial alert query. | Missed | Passed |
The instructions your model reads when the skill loads.
nsm-mcp (NetClaw-authored, spec 091)nsm_status, nsm_update_rules, nsm_alerts, nsm_analyze.pcap/.pcapng file already on disk. Nothing sniffs an interface.Zero alerts is not a clean result until you have checked the signature count.
Stock Suricata loads 0 signatures and reports 0 alerts, announcing it with two
non-fatal warnings. Measured: 0 signatures on stock config versus 52,205 after
nsm_update_rules. A detector that loaded nothing inspected nothing.
nsm_alerts attaches suricata_posture to every response for exactly this reason:
state | What it means | What you may say |
|---|---|---|
ARMED | signatures loaded, detector ran | "no alerts matched the loaded ruleset" |
INERT | 0 signatures | "the detector was off" — never "the traffic is clean" |
UNKNOWN | count seen, no ruleset file | treat with suspicion, re-run after nsm_update_rules |
When posture is INERT, the tool replaces an empty alert list with an object carrying
NOT_A_CLEAN_RESULT. That is deliberate: it cannot be read as a clean verdict by a caller
that only looks at the alert field.
nsm_status — is docker reachable, is a ruleset present, how old is it?nsm_update_rules, then continue. Do not proceed to conclusions on an
INERT run — report that the detector was off and stop.nsm_alerts with min_severity=2 — the alerts worth a human's attention firstnsm_alerts unfiltered — the full picture, noting truncated if setnsm-session-pivot using the
src_ip/dest_ip/dest_port — an alert without its session context is a signature
match, not an incidenttest cases passed, vs 11 / 18 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.