Latest news, tutorials, and insights by Anthony Kasza.
As part of the most recent ZeekWeek event the Zeek Project Training Subgroup and the Corelight Labs Team made a capture the flag (CTF) competition available for attendees to play. The competition included 19 challenges of…
read more about ZeekWeek 2021 Capture the Flag SummaryAnother ZeekWeek means another ZeekWeek CTF! This will be the 2nd year of this event. In full observation of the stereotypical behavior associated with the “terrible twos”, expect defiant and unruly puzzles 😀 What is this…
read more about ZeekWeek 2021 – CTF Announced – Register Today to PlayI recently attempted to better understand script execution flow. As Zeek’s scripting language is heavily driven by events, debugging scripts can, at times, be frustrating and surprising. In an effort to reduce both frustration and surprises…
read more about Functions, hooks, and events. Oh my!As part of the most recent ZeekWeek event a capture the flag (CTF) competition was available for attendees to play. The competition included 12 challenges, of varying difficulties, which involved tasks surrounding Zeek scripting and traffic…
read more about ZeekWeek 2020 Capture the Flag SummaryThis post serves as an introduction to some of the pitfalls I had to learn about whilst writing scripts. Hopefully, they help you avoid the same pitfalls. In some of the below example code snippets, bold…
read more about 7 Dos And Don’ts For Zeek ScriptingI recently tried my hand at writing my first protocol analyzer for Zeek. This is something that I’ve wanted to accomplish since first learning about Zeek. I recall trying to concatenate all the strings from tcp_contents()…
read more about Writing My First Protocol Analyzer