Skip to content

Analyzing Files

  1. Upload a file - click "Choose File" and select a .pcap, .pcapng, .cap, .trace, .evtx, .json, .jsonl, .csv, .xml, .log, or any other file type (or a .zip containing one). File types are auto-detected:
  2. PCAP files → Suricata network analysis
  3. Log files (.evtx, .json, .jsonl, .csv, .xml, .log) → Zircolite Sigma rule detection
  4. Other files → YARA binary scanning
  5. Load from URL - paste a URL to a file and press Enter (or click Go). Password-protected zips from malware-traffic-analysis.net are auto-decrypted using the date-based password format
  6. Reopen a previous analysis - previously analyzed files are listed on the welcome screen
  7. Reanalyze or delete an open analysis - once an analysis is open, its header (next to the notes icon) has reanalyze and delete icons - reanalyze deletes the existing results and re-runs the pipeline in place; delete removes the analysis and returns to the welcome screen. To delete every previous analysis at once, use the Danger Zone section in Settings (Gear Menu → Settings) instead