Zeek

One-liner: Open-source network security monitoring tool that passively observes traffic and generates structured logs for analysis.

🎯 What Is It?

Zeek (formerly known as Bro) is an open-source network security monitoring (NSM) tool. Unlike firewalls or IDS/IPS systems, Zeek does not use signatures or rules to block traffic. Instead, it passively observes network traffic and converts it into structured, enriched logs for security analysis.

Zeek can monitor traffic via:

• Configured SPAN ports (mirror ports)
• Physical network taps
• Imported packet captures (PCAP files)

🤔 Why It Matters

• Incident Response: Rich connection metadata for investigations
• Threat Hunting: Feed logs to tools like RITA for C2 detection
• Forensics: Historical record of all network activity
• Visibility: See what traditional security tools miss

📊 NSM Data Types Zeek Covers

⚡ Quick Reference

Convert PCAP to Zeek Logs

zeek readpcap <pcapfile> <outputdirectory>

# Example
zeek readpcap ~/pcaps/capture.pcap ~/zeek_logs/capture

Read Logs with zeek-cut

# Extract specific fields from conn.log
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service duration

# Filter DNS queries
cat dns.log | zeek-cut query answers

📖 Common Log Files

🔬 Log Field Examples

conn.log Key Fields

🔧 Practical Examples

Find Long Connections (Potential C2)

cat conn.log | zeek-cut id.orig_h id.resp_h duration | awk '$3 > 3600' | sort -t

### Extract All DNS Queries
```bash
cat dns.log | zeek-cut query | sort | uniq -c | sort -rn | head -20

Find Large Data Transfers

cat conn.log | zeek-cut id.orig_h id.resp_h orig_bytes resp_bytes | awk '$3 > 1000000 || $4 > 1000000'

💡 Pro Tips

• Zeek logs are tab-delimited; use zeek-cut for easy field extraction
• Timestamps are in Unix epoch format by default
• Combine with RITA for automated C2 beacon detection
• Use files.log to track extracted files and their hashes
• weird.log often contains early indicators of attacks

🛠️ Integration with Other Tools

🎤 Interview Angles

Common Questions

• "What is Zeek and how is it different from an IDS?"
• "What types of logs does Zeek generate?"
• "How would you use Zeek for threat hunting?"

STAR Story

Situation: Needed to investigate potential Data Exfiltration after an alert on unusual outbound traffic.
Task: Analyze network traffic to identify the exfiltration method and scope.
Action: Converted PCAP to Zeek logs, analyzed conn.log for large outbound transfers, correlated with dns.log for suspicious queries. Found base64-encoded data in DNS TXT queries.
Result: Identified DNS Tunneling exfiltration to attacker-controlled domain. Blocked domain and quantified data loss at ~50MB.

📝 My Use Cases

• Used in C2 Detection - Command & Carol to generate logs for RITA analysis
• Generating network forensics data for incident investigations

🔗 Related Tools

• RITA — C2 detection using Zeek logs
• Wireshark — Deep packet inspection
• Suricata — Signature-based IDS
• tcpdump — Packet capture

📚 References

• Zeek Documentation
• Zeek Log Documentation
• Zeek GitHub
  \t' -k3 -rn | head

### Extract All DNS Queries
{{CODE_BLOCK_3}}

### Find Large Data Transfers
{{CODE_BLOCK_4}}

## 💡 Pro Tips
- Zeek logs are tab-delimited; use `zeek-cut` for easy field extraction
- Timestamps are in Unix epoch format by default
- Combine with [[RITA]] for automated C2 beacon detection
- Use `files.log` to track extracted files and their hashes
- `weird.log` often contains early indicators of attacks

## 🛠️ Integration with Other Tools

| Tool | Integration |
|------|-------------|
| [[RITA]] | Import Zeek logs for C2 analysis |
| [[Splunk]] / [[Elastic]] | Ingest logs for SIEM correlation |
| [[Suricata]] | Combine with signature-based detection |
| [[Wireshark]] | Deep dive into specific packets |

## 🎤 Interview Angles

### Common Questions
- "What is Zeek and how is it different from an IDS?"
- "What types of logs does Zeek generate?"
- "How would you use Zeek for threat hunting?"

### STAR Story
> **Situation:** Needed to investigate potential [[Data Exfiltration]] after an alert on unusual outbound traffic.
> **Task:** Analyze network traffic to identify the exfiltration method and scope.
> **Action:** Converted PCAP to Zeek logs, analyzed `conn.log` for large outbound transfers, correlated with `dns.log` for suspicious queries. Found base64-encoded data in DNS TXT queries.
> **Result:** Identified [[DNS Tunneling]] exfiltration to attacker-controlled domain. Blocked domain and quantified data loss at ~50MB.

## 📝 My Use Cases
- Used in [[C2 Detection - Command & Carol]] to generate logs for RITA analysis
- Generating network forensics data for incident investigations

## 🔗 Related Tools
- [[RITA]] — C2 detection using Zeek logs
- [[Wireshark]] — Deep packet inspection
- [[Suricata]] — Signature-based IDS
- [[tcpdump]] — Packet capture

## 📚 References
- [Zeek Documentation](https://docs.zeek.org/)
- [Zeek Log Documentation](https://docs.zeek.org/en/master/logs/index.html)
- [Zeek GitHub](https://github.com/zeek/zeek)