Zeek – Passive Hostname Enrichment Module
Christos In the process of Threat Hunting or even as a SOC Analyst, it is crucial to know your assets. You have to know which are the SSH Servers, the DNS…
Zeek – Geolocation Enrichment
Continuing my previous post, about ASN Enrichment (https://threathuntingtails.com/zeek-asn-enrichment/), today I will talk about Geolocation Enrichment or how to insert Geolocation Data in your Zeek logs. This feature will provide you…
Zeek – ASN Enrichment
Prior to version 5.0, Zeek has been giving you only the capability to enrich your data with the AS Number (Autonomous Systems Number - https://en.wikipedia.org/wiki/Autonomous_system_(Internet) ) by using the lookup_asn…
Zeek – Suppress SSL/TLS Notices
There are times that you get a lot of Zeek Notices that have no value to your security model or these are false positives. Maybe it will not be in…
Zeek – SMTP URL Extraction
Zeek is a powerful tool for monitoring your networks. It has many powerful capabilities, but the best of all, it is the Zeek script language, that gives you the capability…
