Latest news, tutorials, and insights from the Best Practices category.
Zeek’s JSON logs can get large quickly, especially if you’re ingesting them into a SIEM that charges by data volume. There are two ways to address this: filtering out uninteresting log lines, and renaming fields to…
read more about Reducing Zeek JSON Log Size: Field Name Mapping and Log Filtering HooksAlmost no attack begins with an exploit. It begins with a question: What’s out there? Before anyone tries a default password on your VPN gateway or throws an exploit at an unpatched service, they have to…
read more about How Attackers Learn Your Network Before They Attack ItMost conversations about sensor placement focus on where to tap. Perimeter, core network, east-west segments. Pick your spot and start capturing. But one contributor to this month’s community discussion put it in a way that resonated:…
read more about Zeek Sensor Placement in Practice: Tapping What You Actually UnderstandNetwork security monitoring typically focuses on catching threats. But ask Zeek users what they actually discover in their logs, and a different picture emerges: chatty devices wasting bandwidth, misconfigurations creating millions of unnecessary DNS queries, and…
read more about How to Find Operational Problems Hiding in Your Zeek LogsWith zeek-8.1.0 dns.log now includes information on dynamic update messages (RFC 2136) adding new opcode and opcode_name columns. During the RC phase we received feedback that this change to the log schema might break downstream consumers of dns.log, so we also included a…
read more about Why Zeek keeps breaking your test baselines