What problem does it solve? Without a record of what normal outbound traffic looks like, a machine cannot tell whether a new remote connection is routine or suspicious. This Skill defines that normal state so later monitoring passes can flag connections to destinations never seen before. ## Core Features & Use Cases - Connection Snapshotting: Collects established outbound endpoints via ss -tunp state established, reduced to a sorted, de-duplicated set of address:port pairs. - Baseline Establishment: Writes the snapshot to journal/network-baseline.txt only when no baseline exists, and records a fixed-identity journal note so re-runs never duplicate findings. - Delta Comparison: Diffs the current snapshot against an existing baseline without overwriting it, leaving reporting to the inspect-logs and correlate-findings skills. - Use Case: After hardening a new workstation, run the baseline once; weeks later the monitoring loop flags an unexpected outbound connection to an unfamiliar host because it is absent from the baseline. ## Quick Start Ask the AI to run the baseline-network skill to snapshot this machine's normal outbound connections into the network baseline file.
