Technology and tools
What is Zeek?
An open-source network monitoring tool that turns traffic into detailed logs of connections, DNS, HTTP, TLS and files.
Zeek, formerly known as Bro, is an open-source network analysis framework. Instead of mainly firing alerts, it converts traffic into structured logs: conn.log for every connection, dns.log, http.log, ssl.log, files.log and many more.
Those logs are compact compared with full packet capture and are excellent for threat hunting and investigations, because they record who talked to whom, when, for how long and with which protocol details.