When thinking about use cases for Zeek,
the first one that comes to mind is network security,
right?
That's what many network monitoring systems are being used for,
and this is definitely one of the main use cases for Zeek.
It can essentially be used as an intrusion detection system to
help us detect threats from within our network.
We can detect attacks such as brute force, SQL injection, and malware downloads.
As I've stated before,
you can also create scripts to detect other attacks or other
events within your network so that you can evolve the
capabilities of the system over time.
Another use case that I love this tool for is network monitoring.
As you'll see in the logs when we get to the demo,
you can see so much about your network and the typical protocols within it.
You can see your DNS requests and see where your traffic is going.
You can monitor your HTTP traffic and see where your
requests and responses are going.
What if there's a proxy server that someone's using?
You can have Zeek capture files that are being downloaded or uploaded
and have it create a copy for separate analysis.
I'm telling you, this tool is very powerful if you know how to use it.
You can use it for network statistics too and have it tell you with
the help of a SIM things like how many requests you have for an IP
address per day or how many times you've reached out to DNS servers
not in your environment.
What I really like using it for is detecting what it
classifies as weird traffic though.
I don't know why,
but I guess it's because I started out at the network level and I love it there.
The weird.log shows us our unexpected protocol level
activity according to the Zeek documentation,
pretty much anything that doesn't seem right in the
behavior of the various protocols.
An example would be a bad TCP checksum.
If that wasn't quite right, Zeek would flag this and log it in the weird.log.
I love seeing how the network acts and reacts,
and Zeek allows me to do this effectively.