Zeek
Template:Short description Template:DMCA
Page Module:Infobox/styles.css has no content.
| Zeek | |
|---|---|
| [[Programmer|Original authorTemplate:Pluralize from text]] | Vern Paxson |
| Initial release | 24 January 1998[1] |
| Written in | C++ |
| Engine | Page Template:Plainlist/styles.css has no content.Template:EditAtWikidata |
| Operating system | Linux, FreeBSD, macOS |
| Type | Network intrusion detection system |
| License | BSD license |
| Website | Lua error in package.lua at line 80: module 'Module:If preview' not found. |
| Repository | Page Template:Plainlist/styles.css has no content.
|
Script error: No such module "Check for conflicting parameters".
Lua error in mw.title.lua at line 404: bad argument #2 to 'title.new' (unrecognized namespace name 'Portal'). Zeek is a free and open-source software network analysis framework. Vern Paxson began development work on Zeek in 1995 at Lawrence Berkeley National Lab.[2] Zeek is a network security monitor (NSM) but can also be used as a network intrusion detection system (NIDS).[3] The Zeek project releases the software under the BSD license.
Output
Zeek's purpose is to inspect network traffic and generate a variety of logs describing the activity it sees.[4] A complete list of log files is available at the project documentation site.[5]
Log example
The following is an example of one entry in JSON format from the conn.log:[6]
{
"ts": 1554410064.698965,
"uid": "CMreaf3tGGK2whbqhh",
"id.orig_h": "192.168.144.130",
"id.orig_p": 64277,
"id.resp_h": "192.168.144.2",
"id.resp_p": 53,
"proto": "udp",
"service": "dns",
"duration": 0.320463,
"orig_bytes": 94,
"resp_bytes": 316,
"conn_state": "SF",
"missed_bytes": 0,
"history": "Dd",
"orig_pkts": 2,
"orig_ip_bytes": 150,
"resp_pkts": 2,
"resp_ip_bytes": 372,
"tunnel_parents": []
}
Threat hunting
One of Zeek's primary use cases involves cyber threat hunting.[7]
Name
The principal author, Paxson, originally named the software "Bro" as a warning regarding George Orwell's Big Brother from the novel Nineteen Eighty-Four. In 2018 the project leadership team decided to rename the software. At LBNL in the 1990s, the developers ran their sensors as a pseudo-user named "zeek", thereby inspiring the name change in 2018.[8]
Zeek deployment
Security teams identify locations on their network where they desire visibility. They deploy one or more network taps or enable switch SPAN ports for port mirroring to gain access to traffic. They deploy Zeek on servers with access to those visibility points.[9] The Zeek software on the server deciphers network traffic as logs, writing them to local disk or remote storage.[10]
Zeek application architecture and analyzers
Zeek's event engine analyzes live or recorded network traffic to generate neutral event logs. Zeek uses common ports and dynamic protocol detection (involving signatures as well as behavioral analysis) to identify network protocols.[11]
Developers write Zeek policy scripts in the Turing complete Zeek scripting language. By default Zeek logs information about events to files, but analysts can also configure Zeek to take other actions, such as sending an email, raising an alert, executing a system command, updating an internal metric, or calling another Zeek script.
Zeek analyzers perform application layer decoding, anomaly detection, signature matching and connection analysis.[12] Zeek's developers designed the software to incorporate additional analyzers. The latest method for creating new protocol analyzers relies on the Spicy framework.[13]
References
Page Template:Reflist/styles.css has no content.
- ^ Page Module:Citation/CS1/styles.css has no content."Bro 0.3-alpha". Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content.Paxson, Vern (26 January 1998). "Bro: A System for Detecting Network Intruders in Real-Time" (PDF). USENIX. Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content.McCarty, Ronald (2014). "Network analysis with the Bro Network Security Monitor". ADMIN Magazine. Retrieved 6 July 2023.
- ^ Page Module:Citation/CS1/styles.css has no content."Zeek Network Security Monitor". 22 December 2021. Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content."Zeek Script Reference Log Files". Zeek Documentation. Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content.Wright, Joshua (9 December 2019). "Parsing Zeek JSON Logs with JQ". SANS. Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content.Ooi, Eric (22 November 2023). "Zeekurity Zen - Part IV: Threat Hunting with Zeek". Eric Ooi. Retrieved 20 November 2023.
- ^ Page Module:Citation/CS1/styles.css has no content.Paxson, Vern (11 October 2018). "Renaming the Bro Project".
- ^ Page Module:Citation/CS1/styles.css has no content."Enabling SOHO Network Monitoring". 7 April 2020. Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content.Ooi, Eric (3 January 2019). "Zeekurity Zen Part III: How to Send Zeek Logs to Splunk". Eric Ooi. Retrieved 1 August 2022.
- ^ Page Module:Citation/CS1/styles.css has no content.Grashöfer, Jan; Titze, Christian; Hartenstein, Hannes (2019). "Attacks on Dynamic Protocol Detection of Open Source Network Security Monitoring Tools". arXiv:1912.03962 [cs.NI].
- ^ Template:Cite CiteSeerX
- ^ Page Module:Citation/CS1/styles.css has no content."Spicy". GitHub. 11 June 2022. Retrieved 1 August 2022.
External links
- Lua error in Module:Official_website at line 94: attempt to index field 'wikibase' (a nil value).
- Bro: A System for Detecting Network Intruders in Real-Time – Vern Paxson
- Zeek Nedir? Nasıl Kurulur? – KernelBlog Emre Yılmaz (in Turkish)
