Zeek – Load Certificates to Zeek
Christos
When you deploy your Zeek sensor for the first time, after a while you will mention that a lot of notices will appear to your notice.log, as a result of…
Zeek – Passive Hostname Enrichment Module
In the process of Threat Hunting or even as a SOC Analyst, it is crucial to know your assets. You have to know which are the SSH Servers, the DNS…
Zeek – Geolocation Enrichment
Continuing my previous post, about ASN Enrichment (https://threathuntingtails.com/zeek-asn-enrichment/), today I will talk about Geolocation Enrichment or how to insert Geolocation Data in your Zeek logs. This feature will provide you…
Zeek – ASN Enrichment
Prior to version 5.0, Zeek has been giving you only the capability to enrich your data with the AS Number (Autonomous Systems Number – https://en.wikipedia.org/wiki/Autonomous_system_(Internet) ) by using the lookup_asn…
Zeek – Suppress SSL/TLS Notices
There are times that you get a lot of Zeek Notices that have no value to your security model or these are false positives. Maybe it will not be in…
