Next, configure the run time environment and define the local networks to monitorĤ. You can install the code directly from the sourceģ.You can install from a pre-built binary package.Before you install Zeek, make sure you have all the required dependencies You can find older versions of Zeek on various GitHub pages if there is a deprecated feature you wish to useĢ.Get the latest version of Zeek that works best with the system and distro you plan to install it on (E.g., Ubuntu)
It extracts fields in network data to provide teams with parsed and actionable information that can then be used to craft meaningful detections to better secure the network.
If configured correctly, it does not boggle down the network or overload security teams with useless data. Zeek is a great source of network data for hunting, monitoring and analysis. However, a lot of the time, this data is incomplete or extremely expensive to capture. You can collect it via a firewall, netflow or other network analysis tools/technologies. There are many different ways to collect network data. To create a complete picture of what’s occurring in your network, you must first understand what systems and services are connecting to and how traffic flows through your organization’s IT environment. Good network data is key when investigating security events and crafting good detections. A common use of these files is to ingest them into a SIEM platform to craft detections. We will explore a few of these in the below sections to learn how they can be used. The processed data is then stored into various log files (dns.log, http.log, con.log etc.). It then takes that traffic and processes, parses and structures the network data based on protocols. The tool mirrors (or SPAN) a router within your network to collect a copy of the traffic.
0 kommentar(er)
