Lesson 1.20: Hunting in Zeek logs: zeek-cut and uids

Blue Team 101 read conn.log with awk and column numbers. At scale you need more: zeek-cut selects fields by name and converts timestamps, local_orig and local_resp separate inside from outside without guessing address ranges, and every log line carries a uid that links one connection across conn.log, ssl.log, http.log and the rest. In the lab you hunt through a night of Northwind's logs, find a finance workstation that sent 2.4 GB to the internet, follow its uid into the TLS log to see what kind of client it was, and pin down the exact time window.

16 min

You will learn to

Read Zeek log headers, fields and types
Select fields by name with zeek-cut
Separate internal and external traffic with local_resp
Link one connection across logs with its uid
Build an exact timeline

Key terms

NSM (network security monitoring): Collecting and analysing network data to detect and investigate intrusions.
Zeek: An open-source network monitor that turns traffic into structured logs (conn, dns, http, ssl …).
SPAN port / TAP: A switch port or device that copies traffic to a sensor without being in the path.
Originator / responder: The side that opened the connection / the side that answered.
uid: Zeek's unique identifier for a connection, repeated in every log that describes it.
local_orig / local_resp: T when that side's address is in the networks Zeek was told are local.
Exfiltration: Moving data out of an organisation without authorisation.

← What is a computer network? · All lessons · The attack surface of a host →