https://github.com/githubfoam/zeek-sandbox
zeek network security monitoring NIDS HIDS
https://github.com/githubfoam/zeek-sandbox
cyber-threat-intelligence digital-forensic-readiness digital-forensics-incident-response hids host-based intrusion-detection-system network-based network-security-monitoring nids pipeline zeek
Last synced: 7 months ago
JSON representation
zeek network security monitoring NIDS HIDS
- Host: GitHub
- URL: https://github.com/githubfoam/zeek-sandbox
- Owner: githubfoam
- License: gpl-3.0
- Created: 2019-11-28T08:56:55.000Z (almost 6 years ago)
- Default Branch: master
- Last Pushed: 2020-10-17T22:13:09.000Z (almost 5 years ago)
- Last Synced: 2025-02-05T07:49:41.023Z (8 months ago)
- Topics: cyber-threat-intelligence, digital-forensic-readiness, digital-forensics-incident-response, hids, host-based, intrusion-detection-system, network-based, network-security-monitoring, nids, pipeline, zeek
- Language: Ruby
- Size: 68.4 KB
- Stars: 2
- Watchers: 1
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# zeek sandbox
Travis (.com) branch:
[](https://travis-ci.com/githubfoam/zeek-sandbox)
~~~~
vagrant up
$ export PATH=/opt/zeek/bin:$PATH
~~~~
~~~~
wget https://www.malware-traffic-analysis.net/2018/CTF/2018-CTF-from-malware-traffic-analysis.net-1-of-2.pcap.zip
https://www.malware-traffic-analysis.net/2018/CTF/index.htm
$ unzip 2018-CTF-from-malware-traffic-analysis.net-2-of-2.pcap.zip
password:infected
zeek -Cr 2018-CTF-from-malware-traffic-analysis.net-2-of-2.pcap
[vagrant@vg-zeek-02 ~]$ cat dhcp.log | zeek-cut mac
00:1e:67:4a:d7:5c
00:1e:67:4a:d7:5c
00:1e:67:4a:d7:5c
[vagrant@vg-zeek-02 ~]$ cat dhcp.log | zeek-cut client_addr
172.17.1.129
172.17.1.129
172.17.1.129
Q1: What is the MAC address of the Windows client at 172.17.1.129?
[vagrant@vg-zeek-02 ~]$ cat dhcp.log | zeek-cut mac client_addr | sort | uniq
00:1e:67:4a:d7:5c 172.17.1.129
Q2: What is the host name for the Windows client at 172.17.1.129?
$ cat dhcp.log | zeek-cut client_addr host_name | sort | uniq
172.17.1.129 Nalyvaiko-PC
~~~~
~~~~
"zeek-source" role, platform independent building from git source
~~~~