Latest news, tutorials, and insights from the How-to category.
This is Part 3 of a three-part series. Read Part 1 and Part 2. Introduction Back in Part 1 and Part 2, we presented our motivational package, ip-distance, how you can easily write unit tests in…
read more about The Cure for Exceptional Zeek Package Testing (Part 3)This is Part 2 of a three-part series. Read Part 1 and Part 3. Introduction In the previous part of this blog series, we presented our motivational package, ip-distance, and how you can easily write unit…
read more about The Cure for Exceptional Zeek Package Testing (Part 2)This is Part 1 of a three-part series. Read Part 2 and Part 3. Introduction As someone who ships a lot of Zeek packages to production, I’m always looking for ways to improve package testing. In…
read more about The Cure for Exceptional Zeek Package Testing (Part 1)Zeek can write the same log stream in multiple formats simultaneously. If you need JSON for your SIEM and TSV for long-term archives, you’re in luck: a few lines of code handles both. There are several…
read more about How to Write Zeek Logs in JSON & TSV SimultaneouslyBlocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this…
read more about Reduce conn.log from 35GB to 5GB with a Simple HookWhether you’re extending Zeek’s functionality or integrating it into a larger NDR stack, your work probably involves some form of source code. While that code is ultimately a means to an end, I like code to…
read more about Developing Zeek Scripts with Style