Network security monitoring with Zeek
You read the connection, DNS, HTTP, TLS and file records Zeek produces, analyse them with zeek-cut, write your own scripts and find suspicious behaviour that has no signature.
Level 301 · 15 lessons · 15 practice labs
Lessons
The logs
- How Zeek differs from a signature-based IDS
- conn.log: a summary of every connection
- dns.log and http.log
- ssl.log, x509.log and files.log
- Analysis with zeek-cut and shell tools
- Short task: find the five internal hosts that sent the most data
Finding behaviour
- Long-lived connections and tunnels
- Regularly spaced connections: beaconing
- Rare TLS fingerprints and self-signed certificates
- Short task: find the host that calls out every 60 seconds
Scripts
- The Zeek scripting language: events and records
- The notice framework: raising your own notice
- The intel framework: matching against an indicator list
- Short task: raise a notice for queries to an unknown DNS server
Capstone
- Capstone: find hidden data exfiltration in a week of Zeek logs
Practice labs
- Find the internal host that sent the most data in conn.log: Sum bytes sent per source with zeek-cut and sort and write down the top one.
- Find the rare domain queried most in dns.log: Count queries per domain and identify the domain only one host queries.
- Find an executable download in http.log: Find a download whose MIME type and extension disagree and match it to its hash in files.log.
- Follow one connection through every log by uid: Follow a suspicious connection’s uid through conn, ssl and x509 records and extract the certificate details.
- Catch SSH on a non-standard port from the service field: Find connections whose service field and port disagree and report the SSH running on 443.
- Find the connection left open for hours: Sort conn.log by duration and note the endpoints and data volume of the longest connection.
- Find the host calling out every five minutes: Calculate the intervals between connections to the same destination and show the source with a regular pattern.
- List outbound connections with self-signed certificates: Join ssl.log and x509.log and list external servers presenting self-signed certificates and their clients.
- Pick out the client with the rare TLS fingerprint: Count JA3 values and find the fingerprint seen on only one host and the addresses it connects to.
- Write a Zeek script that handles an event and prints a line: Write a script printing source and destination on the new connection event and run it against a capture.
- Raise a notice for queries to an unknown DNS server: Write a script raising a notice for queries outside the allowed resolver list and show it in notice.log.
- Match an indicator list with the intel framework: Load domain and address indicators, process the capture and show hits with their source in intel.log.
- Write a thresholded notice for large uploads: Raise a notice for more than 50 MB sent out in one connection and exempt the backup server.
- Start from a hash and trace a file’s whole journey on the network: From a hash in files.log pivot to http, conn and dns records and state who downloaded the file, from where, through which domain and where they connected afterwards.
- Count the notice.log records by type: Count the notice types in a day of notice.log and name the most frequent one and the one seen only once.
About this course
You read the connection, DNS, HTTP, TLS and file records Zeek produces, analyse them with zeek-cut, write your own scripts and find suspicious behaviour that has no signature.
What you will learn
- The logs
- Finding behaviour
- Scripts
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.