# exfilwatch

> exfilwatch — cognis-digital-exfilwatch. Use this tool when you need to detect and identify potential data exfiltration attempts in your network logs. Exfilwatch analyzes DNS and HTTP logs to identify suspicious patterns, such as high entropy and beaconing activity, indicating possible exfiltration attempts. It takes log data as input and outputs alerts and notifications for further investigation, making it a valuable asset in security monitoring and threat detection contexts.

Canonical page: https://skillsregistry.net/skills/cognis-digital-exfilwatch  
JSON: https://api.skillsregistry.net/v1/skills/cognis-digital-exfilwatch

## Description

Detect DNS/HTTP exfiltration patterns (entropy, beaconing) in logs

## Trust

- **Trust score (0–1):** 0.50
- **Verification tier:** unverified

## Facts

- **Version:** 1.0.0
- **Skill type:** atomic
- **Execution layer:** container
- **Runtime environment:** vm
- **Updated:** 2026-09-21

## Source

- **Source listing:** [GitHub](https://github.com/cognis-digital/exfilwatch)

## Use it

Resolve this record through the SkillsRegistry MCP server (no auth, read-only):

```
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp
```

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_skill",
    "arguments": {
      "slug": "cognis-digital-exfilwatch"
    }
  }
}
```

REST: `GET https://api.skillsregistry.net/v1/skills/cognis-digital-exfilwatch` · pull for local use: `GET https://api.skillsregistry.net/v1/skills/cognis-digital-exfilwatch/pull`

---
SkillsRegistry indexes agent skills from public registries and GitHub. Skills we have analysed are scanned with Circle-IR and scored on six dimensions; each listing states its scan coverage. More: https://skillsregistry.net/llms.txt