Network Traffic Analysis with Zeek

This skill empowers security engineers and developers to transform raw network traffic into structured, actionable intelligence using Zeek. It provides a complete framework for deploying Zeek clusters, managing high-fidelity protocol logs (HTTP, DNS, TLS, SSH), and implementing custom behavioral detection scripts. By leveraging Zeek's passive monitoring capabilities, users can conduct deep forensic investigations, identify protocol anomalies, and integrate rich network telemetry directly into SIEM platforms like ELK or Splunk for enterprise-wide visibility.

主な機能

ユースケース