Zeek Data Beyond Threat Detection

When the security cameras on one network weren’t syncing properly, the ntp logs were where one practitioner went looking. It’s the only time they’ve opened those logs, and they didn’t find much that helped, though they’re sure something useful must be in there.

Another practitioner skips the ntp logs entirely, while admitting there’s probably some interesting data in them: “I just can’t get myself pumped up about time.”

October’s Topic of the Month asked all about Zeek data: What are you using it for besides threat detection? What questions has it answered for you? What are you not checking? We learned a lot about what folks are doing (or not doing) with that data and how they make it work for them.

Answering one-off questions from colleagues

Zeek can be helpful for uncovering answers to one-off questions, one contributor said. The example they gave was being asked about the history of SSH clients connecting to systems at the research computing facility where they work. Their reaction: “Well… I think I have that data.” Sure enough, it was there.

While requests like this show up without warning, the answer is on hand because Zeek had been recording that data all along. People may not realize how much data Zeek collects, and security teams are probably sitting on data that could help other teams. This contributor makes a point to “stay cognizant about what Zeek is recording.”

Tracking expiring TLS certificates with Zeek data

Another quick anecdote we heard was about keeping an eye on certificates. One team had problems with TLS certs expiring on them, so they built a dashboard from their Zeek data that highlighted certs in use on the network that were about to expire. It was, to put it in their works, a “stupid simple, but effective” solution.

The dashboard turned an operational headache into a standing check. For a team that had already been caught out by expiring certs, a simple view of upcoming expirations was enough to get ahead of the next one.

Finding out what’s on a network with Zeek

The most detailed story came through our anonymous Topic of the Month form. While trialing a passive network tap running Zeek on a friend’s small shop network, the submitter kept seeing weird long DNS queries and other things in Zeek’s logs that shouldn’t have been popping up. A workstation they knew ran Windows 10 Home was reporting itself as Windows 10 Enterprise. There was also an active TeamViewer connection the owner said she had never installed or used, on a network that included a point-of-sale machine.

After days of trying to figure it out, they traced it to the purchase: the computer was a refurbished former corporate machine with “ghost artifacts” left over from a poor wipe, and it had been running with several active backdoors. A reimage settled the network down. The person who submitted this story credits this discovery to Zeek and their own curiosity.

What are you doing with your Zeek data?

Whether it’s a question a colleague brought you, a dashboard that saves your team some trouble or something unexpected on a home lab network, we’d like to hear how you’re using your Zeek data outside threat detection. Jump into the Zeek Slack and let us know.

Thank you to everyone who contributed to October’s conversation: Dop, Jim, Sujala, Kevin, Aaron, Jakob, Pedro, Nicolas, Trong, Timothy, Sabyasachi, Chris C., and Yacin.

November’s topic is “Another Day, Another CVE.” Join us in #topic-of-the-month on the Zeek Slack and tell us how you handle CVEs and whether or not Zeek fits into that process.