#zeek — Public Fediverse posts

the #zeek workshop was awesome! i won't be at the training tomorrow because i gotta get some work done but i'm gonna be in town a little longer so i might try to sneak off to a book store or something

the #zeek workshop was awesome! i won't be at the training tomorrow because i gotta get some work done but i'm gonna be in town a little longer so i might try to sneak off to a book store or something

the #zeek workshop was awesome! i won't be at the training tomorrow because i gotta get some work done but i'm gonna be in town a little longer so i might try to sneak off to a book store or something

Made a transparent network bridge on #NixOS which sits between router & #LAN switch, monitoring traffic for #IDS #intrusiondetection , #Suricata and #Zeek capture and analyze packets → #Filebeat ships #logs → #Elasticsearch with #GeoIP ingest pipeline → #Grafana setup of dashboard to visualise data is defined in flake itself so using the flake will give the same dashboard. #flake details here https://codeberg.org/adingbatponder/reticulum_nixos_flake/src/branch/main/features/network-appliance
Hardware: HP EliteDesk 800 G1 SFF 16Gb RAM & https://www.jacob.de/produkte/Intel-Ethernet-Server-Adapter-I350-T4-I350T4V2-artnr-2094756.html #i350t4

This project is a SIEM with SIRP and Threat Intel, all in one.

https://github.com/V1D1AN/S1EM

#docker #elasticsearch #kibana #logstash #filebeat #malware #suricata #misp #thehive #cortex #sigma #yara #zeek #opencti #mwdb #n8n #velociraptor #arkime #zircolite

How to filter zeek logs:

cat conn.log | zeek-cut <columns> | column -t | less -S

(column and less display the columns aligned and readable)

#DFIR #knowledgedrop #NIDS #zeek