Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.
Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.
Zeek (formerly Bro) is an open-source network analysis framework that operates as a passive network security monitor. Unlike traditional signature-based IDS tools, Zeek generates high-fidelity structured logs from observed network traffic, capturing detailed metadata for protocols including HTTP, DNS, TLS, SSH, SMTP, FTP, and dozens more. Zeek's extensible scripting language enables custom detection logic, behavioral analysis, and automated response. This skill covers deploying Zeek, understanding its log architecture, writing custom detection scripts, and integrating outputs with SIEM platforms.
When to Use
When conducting security assessments that involve performing network traffic analysis with zeek
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Linux server (Ubuntu 22.04+ or CentOS 8+) with 4+ CPU cores and 8GB+ RAM
Network TAP or SPAN port mirroring configured for traffic capture
Zeek 6.0+ installed (via package manager or source compilation)
Root or capture group privileges for packet capture
SIEM platform (Splunk, ELK Stack, or QRadar) for log ingestion
Core Concepts
Zeek Architecture
Zeek operates in two main modes:
Live Capture - Monitors traffic in real-time on one or more network interfaces
Offline Analysis - Processes saved PCAP files for retrospective analysis
The processing pipeline consists of:
Packet Capture Layer - Reads raw packets from interfaces or PCAP files
Event Engine - Reassembles TCP streams and generates protocol events
Script Interpreter - Executes Zeek scripts that process events and generate logs
Log Framework - Writes structured logs in TSV, JSON, or custom formats
Log Architecture
Zeek generates protocol-specific log files:
Log File
Description
conn.log
TCP/UDP/ICMP connection summaries with duration, bytes, state
dns.log
DNS queries and responses with query type, answers, TTL
http.log
HTTP requests/responses with URIs, user agents, MIME types
ssl.log
TLS handshake details including certificate chain, JA3/JA3S
files.log
File transfers with MIME types, hashes (MD5, SHA1, SHA256)
notice.log
Alerts generated by Zeek detection scripts
weird.log
Protocol anomalies and unexpected behaviors
x509.log
Certificate details from TLS connections
smtp.log
Email metadata including sender, recipient, subject
Intel file format (/opt/zeek/intel/malicious-ips.intel):
#fields indicator indicator_type meta.source meta.desc meta.do_notice
198.51.100.50 Intel::ADDR abuse.ch Known C2 server T
203.0.113.100 Intel::ADDR threatfeed Ransomware infrastructure T
Step 5: Deploy and Operate
# Deploy Zeek clustersudo /opt/zeek/bin/zeekctl deploy
# Check cluster statussudo /opt/zeek/bin/zeekctl status
# Process offline PCAP
zeek -r capture.pcap local.zeek
# View logscat /opt/zeek/logs/current/conn.log | zeek-cut id.orig_h id.resp_h id.resp_p proto service duration orig_bytes resp_bytes
# Search for specific connectionscat /opt/zeek/logs/current/dns.log | zeek-cut query answers | grep -i "suspicious"# Rotate logssudo /opt/zeek/bin/zeekctl cron
