Skip to content

Usage

Once you've connected to SO-CRATES in your browser, here are some of the things you can do.

Analyze a File

  1. Upload a file — click "Choose File" and select a .pcap, .pcapng, .cap, .trace, .evtx, .json, .jsonl, .csv, .xml, .log, or any other file type (or a .zip containing one). File types are auto-detected:
  2. PCAP files → Suricata network analysis
  3. Log files (.evtx, .json, .jsonl, .csv, .xml, .log) → Zircolite Sigma rule detection
  4. Other files → YARA binary scanning
  5. Load from URL — paste a URL to a file and press Enter (or click Go). Password-protected zips from malware-traffic-analysis.net are auto-decrypted using the date-based password format
  6. Reopen a previous analysis — previously analyzed files are listed on the welcome screen
  7. Re-analyze a previous file — click the re-analyze button next to any previous file to delete its analysis and re-run the pipeline

After analysis completes, the UI displays different views depending on the file type:

For PCAP files:

  • Stats Grid — clickable cards showing event counts by type (Alerts, DNS, HTTP, TLS, Flows, etc.)
  • Sankey Diagram — expand the collapsible heading to visualize network flow relationships (Source IP → Dest IP → Dest Port)
  • Aggregation Tables — frequency counts for each column; click a value to filter
  • Data Table — sortable table with expandable detail rows showing full event JSON, ASCII transcripts, and hexdumps
  • Search — full-text search across all event data using SQLite FTS5 (falls back to LIKE if FTS5 is unavailable)
  • Filtering — apply filters by clicking aggregation values; filter chips show active filters; filters persist across all tabs and the Sankey diagram

For log files (.evtx, .json, .csv, .xml, .log):

  • Sigma Alerts — detections matched by Sigma rules, with severity, MITRE techniques, and rule metadata
  • Log Events — all parsed log events with dynamic column discovery based on the actual data
  • Aggregation Tables — filterable counts for discovered fields (Channel, EventID, Image, Source IP, etc.)
  • Search & Filtering — same full-text search and aggregation-click filtering as PCAP mode

For binary files:

  • File Info — metadata extracted from the file
  • YARA Matches — any rules that matched, with tags and author attribution

Stream Analysis

Click any row in a data table to expand it, then:

  • ASCII Transcript — view decoded TCP/UDP payload as readable text
  • Hexdump — view per-packet hex dumps with collapsible packet headers
  • Download PCAP — carve that specific stream into a standalone .pcap file