Zeek

• 10 August 2024
• draft,
• traffic,
• monitoring,
• network,
• security,
• draft

🚧 This post is a work in progress 🚧

• Open-source network traffic analyser
• Useful to:
  • find signs of suspicious or malicious activity investigations
  • troubleshoot network issues
• Zeek also has a scripting language, which allows users to craft Zeek scripts (similar to Suricata rules).

Zeek logs #

Some interesting logs include:

• conn.log that provides details about IP, TCP, UDP, and ICMP connections
• dns.log: details of DNS queries and responses
• http.log captures the details of HTTP requests and responses
• ftp.log: Details of FTP requests and responses are logged here
• smtp.log: This log covers SMTP transactions, such as sender and recipient details

For example, http.log contains the following fields:

• host: The HTTP domain/IP
• uri: The HTTP URI
• referrer: The referrer of the HTTP request
• user_agent: The client's user agent
• status_code: The HTTP status code

Check Zeek logs documentation for more info

• Previous: Sysmon
• Next: Setting up a SIEM [wip]