This is Part 3 of a three-part series. Read Part 1 and Part 2. Introduction Back in Part 1 and Part 2, we presented our motivational package, ip-distance, how you can easily write unit tests in…
read more about The Cure for Exceptional Zeek Package Testing (Part 3)This is Part 2 of a three-part series. Read Part 1 and Part 3. Introduction In the previous part of this blog series, we presented our motivational package, ip-distance, and how you can easily write unit…
read more about The Cure for Exceptional Zeek Package Testing (Part 2)Zeek can write the same log stream in multiple formats simultaneously. If you need JSON for your SIEM and TSV for long-term archives, you’re in luck: a few lines of code handles both. There are several…
read more about How to Write Zeek Logs in JSON & TSV SimultaneouslyBlocking scanners at your network edge solves one problem but creates another: Zeek will log every failed connection attempt, filling conn.log with noise from hosts you’ve already blocked. A simple log filtering hook can eliminate this…
read more about Reduce conn.log from 35GB to 5GB with a Simple HookYour first Zeek script doesn’t need to detect malware, stop threats, or solve a critical security problem. In fact, it probably shouldn’t. David Fitz learned Zeek through a SANS course and wanted to try his first…
read more about Your First Zeek Script Doesn’t Need to Be Perfect