mytechnotalent / zeek-network-security-monitor

A Zeek Network Security Monitor tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and finally provide some examples of how you can use the power of Zeek to have absolute control over your network.

FREE Reverse Engineering Self-Study Course HERE

Zeek Network Security Monitor Tutorial

A Zeek Network Security Monitor tutorial that will cover the basics of creating a Zeek instance on your network in addition to all of the necessary hardware and setup and provide some examples of how you can use the power of Zeek to have absolute control over your network.

Lesson 1: Setup

In this lesson we set up a basic Ubuntu computer connected directly to an inexpensive tap which connects to your home router. I have provided products you can purchase if you do not have existing parts however please feel free to use any network tap of your choosing and/or any additional Ethernet adapters or cables of your choosing.

-> Click HERE to read the article on Medium.

Lesson 2: alert-all-notices.zeek

In this lesson we create an alert by logging all notices that Zeek deems worthy of your attention to the notice.log file in addition to sending you an email.

-> Click HERE to read the article on Medium.

Lesson 3: conn.log

In this lesson we will show the source IP addresses and ports and their destination IP addresses and ports.

-> Click HERE to read the article on Medium.

Lesson 4: conn.log - 2

In this lesson we will show the source IP addresses that generated the most network traffic, organized in descending order.

-> Click HERE to read the article on Medium.

Lesson 5: conn.log - 3

In this lesson we will show the destination ports that received the most network traffic, organized in descending order.

-> Click HERE to read the article on Medium.

Lesson 6: conn.log - 4

In this lesson we will show the number of connections per protocol service.

-> Click HERE to read the article on Medium.

Lesson 7: conn.log - 5

In this lesson we will show the distinct browsers used by the hosts.

-> Click HERE to read the article on Medium.

Lesson 8: conn.log - 6

In this lesson we will show the source and destination IP addresses of all UDP and TCP connections that lasted more than 90 seconds.

-> Click HERE to read the article on Medium.

Lesson 9: conn.log - 7

In this lesson we will show whether there any web servers operating on non-standardized ports.

-> Click HERE to read the article on Medium.

Lesson 10: conn.log - 8

In this lesson we will show the state history of connections as a string of letters.

-> Click HERE to read the article on Medium.

License

Apache License, Version 2.0