Zeek fundamentals: turning traffic into logs
With Zeek you turn live traffic and PCAP files into structured logs and read an incident from conn, dns, http, ssl and files logs.
Level 201 · 17 lessons · 15 practice labs
Lessons
Getting started with Zeek
- What Zeek is: event-driven network monitoring, not signatures
- Running Zeek on a PCAP: zeek -r
- The Zeek log format: TSV and JSON, linking by uid
- Setting up live monitoring with zeekctl
- Short task: generate logs from a PCAP and count the connections
Core logs
- conn.log: duration, bytes, conn_state and history
- Following queries and answers with dns.log
- http.log: method, URI, user agent, status code
- ssl.log and x509.log: server names and certificates
- files.log: transferred files and their hashes
- Short task: follow one uid across conn, http and files logs
Working with logs
- Quick summaries with zeek-cut, sort and uniq
- Querying JSON Zeek logs with jq
- notice.log and weird.log: what Zeek finds strange
- Zeek’s built-in detections: scans, SSH brute force, old protocols
- Short task: list the five internal hosts sending the most data
- Capstone: rebuild a malicious download incident from Zeek logs
Practice labs
- Produce Zeek logs from a PCAP: Process a capture with zeek -r, list the log files produced and state the number of connections.
- Switch from TSV to JSON output: Reprocess the same capture with JSON logging and show the same connection by uid in both formats.
- Set up live monitoring with zeekctl: Deploy Zeek on the lab interface with zeekctl, verify its status and show the first conn.log lines from live traffic.
- The longest connections: List the top ten connections by duration from conn.log with source, destination and service.
- Interpret conn_state values: Count the S0, REJ, SF and RSTO states and explain one example connection for each.
- Read a session from the history field: From the history string of five connections write who started it, whether data flowed and how it closed.
- Match queries and answers in dns.log: List the names one host queried and the answer addresses it received from dns.log.
- User agents in http.log: Count the user agents in http.log and show the ones that do not look like browsers with their request URIs.
- Join the ssl and x509 logs: Report the servers presenting self-signed certificates by server name by joining ssl.log and x509.log.
- Transferred files in files.log: Count the transferred files by MIME type and list those of executable type with their hashes.
- Follow one uid across three logs: Follow a download's uid through the conn, http and files logs and produce a one-line summary.
- Reconstruct a download incident: From Mavikaya Lojistik's prepared logs, order from which page, to which host and when the suspicious file was downloaded.
- A quick summary with zeek-cut: Count the ten most contacted destination ports with zeek-cut, sort and uniq.
- The five internal hosts sending the most data: Sum the bytes sent per host in conn.log and list the top five.
- Sort through the notice and weird logs: Count notice.log and weird.log entries by type and pick three worth investigating with reasons.
About this course
With Zeek you turn live traffic and PCAP files into structured logs and read an incident from conn, dns, http, ssl and files logs.
What you will learn
- Getting started with Zeek
- Core logs
- Working with logs
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.