Suricata – Suricata Monitoring with Zabbix
Christos In this post, we will onboard a Suricata Sensor on Zabbix so we can basic metrics for our sensor. The metrics will be collected through suricatasc command. Also we will…
Zeek – Network File Extraction
One of the most awesome capabilities of Zeek, except the scriptable nature, is the network file extraction a.k.a file carving. The network file extraction allows you to extract the file…
Decapsulating HP-ERM Remote SPAN
In the previous days, I tried to consume SPAN traffic from an HP Switch that provides the traffic with its protocol, the HP ERM (HP Encapsulated Remote Mirror) Remote SPAN.…
Zeek – Restrict Capturing Traffic with BPF Filters
By default, Zeek is configured to capture all the network traffic, both IP and Non-IP traffic. But if you have worked as a Network/SysAdmin Engineer you will have detected protocols…
Zeek – Load Certificates to Zeek
When you deploy your Zeek sensor for the first time, after a while you will mention that a lot of notices will appear to your notice.log, as a result of…
