Latest news, tutorials, and insights from the Zeek in Action category.
In this episode of Zeek in Action, Richard examines the four types of network security monitoring data: 1) full content data (“PCAP”), 2) transaction logs, 3) extracted content, and 4) intrusion detection systems (IDS) alerts. He…
read more about Zeek in Action, Video 10, Examining the Four Types of Network Security Monitoring DataIn this Zeek in Action video, Keith Jones explains his Spicy protocol analyzer rapid development process on a new Radius analyzer. Of course Radius is in core Zeek, but it can be replaced with a Spicy…
read more about Zeek In Action, Video 9, Radius Protocol Analyzer with SpicyIn this Zeek in Action video, Richard Bejtlich explains how to install Zeek from scratch, using a fresh Linux environment created on his Windows system with VirtualBox. You can follow along step by step as Richard…
read more about Zeek In Action, Video 8, Installing Zeek From ScratchIn this episode, Richard Bejtlich explains how to determine if your Zeek deployment suffers from capture loss. There are many causes for capture loss (including an overloaded span port, NIC, or monitoring system), but the end…
read more about Zeek In Action, Video 7, Capture Loss StatisticsAfter seeing questions such as, “Can I use Zeek to monitor my wireless network traffic?” on the Zeek Slack workspace, Richard Bejtlich wanted to take a broader look at this question. In this episode, Richard looks…
read more about Zeek in Action, Video 6, How to Monitor Wireless NetworksDo you ever see new assets on your network and wonder what they are? Maybe there are devices you don’t recognize and you want to know more. In this episode, Richard Bejtlich looks at how to…
read more about Zeek in Action, Video 5, What is this New Device?In this episode, Richard Bejtlich explores how to figure out where to put a sensor on your network. He describes a simple enterprise network, traffic flows, and device addressing, all of which affect sensor placement. Find…
read more about Zeek in Action, Video 4, Where Should I Put My Sensor?In this episode, Richard Bejtlich looks at PCAPs from Tcpreplay using Zeek, Brim Security and Wireshark. This comparison isn’t to say one tool is better than the other, but to show users what data each tool…
read more about Zeek in Action, Video 3, Comparisons of Data SourcesIn this episode, Richard Bejtlich traces a trickbot infection known as CATBOMBER, posted by Brad Duncan on his Malware Traffic Analysis site. Richard uses try.zeek.org to look at the PCAP for signs of suspicious and malicious…
read more about Zeek In Action, Video 2, Tracing a Trickbot InfectionThe first video examining network traffic using Zeek and related applications is now available. This episode looks at a suspected malware compromise, posted by Brad Duncan on his Malware Traffic Analysis site. We use Brim to…
read more about Welcome to Zeek in Action, Video 1, Suspected Malware Compromise