Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Brim

Learn and practice log investigation, pcap analysis and threat hunting with Brim.

Task 1: Introduction

Task 2: What is Brim?

Task 3: The Basics

Task 4: Default Queries

Task 5: Use Cases

Task 6: Exercise: Threat Hunting with Brim | Malware C2 Detection

Task 7: Exercise: Threat Hunting with Brim | Crypto Mining

Task 8: Conclusion

Back to all walkthroughs
Room Icon

Brim

Premium room

Learn and practice log investigation, pcap analysis and threat hunting with Brim.

medium

120 min

32,777

User profile photo.

To access material, start machines and answer questions login.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Lab machine
Status:Off

BRIM is an open-source desktop application that processes files and logs files. Its primary focus is providing search and analytics. In this room, you will learn how to use Brim, process pcap files and investigate log files to find the needle in the haystack! This room expects you to be familiar with basic security concepts and processing log files. We suggest completing the "Network Fundamentals" path and the "Zeek room" before starting working in this room. 

A  is attached to this room. You don't need or ; the room provides a "Split View" feature. Exercise files are located in the folder on the desktop. 
NOTE: DO NOT directly interact with any domains and IP addresses in this room. 

Brim - interactive material

Answer the questions below
Read the task above.