domains / families / security / performing-network-traffic-analysis-with-zeek

performing-network-traffic-analysis-with-zeek

separate

Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.

When to use

• When conducting security assessments that involve performing network traffic analysis with zeek
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

When not to use

• raw PCAP analysis

Skill page

Source