Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Network Monitoring with Zeek

Use Zeek logs to trace beaconing, DNS tunnelling, exfiltration, and noisy detections.

Task 1: Introduction

Task 2: Reading Connection Records with Zeek

Task 3: DNS Visibility and Tunnelling Detection

Task 4: HTTP and TLS Protocol Logs

Task 5: File Metadata and Hash Correlation

Task 6: Cross-Log Correlation

Task 7: Writing a Detection Notice

Task 8: Conclusion