building-zeek-analytics-for-hunting

Name: building-zeek-analytics-for-hunting
Author: meltedinhex

18stars5forks

How to install building-zeek-analytics-for-hunting?

meltedinhex/analyst-ai-pack/building-zeek-analytics-for-hunting

$npx -y skills add meltedinhex/analyst-ai-pack --skill building-zeek-analytics-for-hunting

Installs into the current project.

Summary

Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs

Files · 1

View on GitHub

SKILL.md

1	# Building Zeek Analytics for Hunting
2
3	## When to Use
4
5	- You have Zeek logs (conn.log, dns.log, http.log, ssl.log, files.log) and want to build hunting
6	analytics: long-lived connections, rare JA3 fingerprints, suspicious file downloads, and
7	beaconing.
8	- You want repeatable detections expressed as Zeek scripts or log-analysis queries.
9
10	Do not use Zeek to actively probe hosts — it is passive analysis of captured/sensor traffic.
11
12	## Prerequisites
13
14	- Zeek logs in TSV or JSON (or a running Zeek sensor). The script analyzes exported logs.
15
16	## Workflow
17
18	### Step 1: Analyze a Zeek log for anomalies
19
20	```bash
21	python scripts/analyst.py analyze conn.log --kind conn
22	```
23
24	For `conn`, surfaces long-duration and high-byte connections; for `ssl`, counts JA3 rarity; for
25	`http`, flags executable/script downloads and rare user-agents; for `dns`, flags long/high-entropy
26	queries.
27
28	### Step 2: Express the logic as a Zeek script (optional)
29
30	Translate a confirmed pattern into a Zeek script using the appropriate event
31	(`connection_state_remove`, `ssl_established`, `http_reply`).
32
33	### Step 3: Confirm
34
35	Corroborate anomalies with destination reputation and other logs (pivot by `uid`).
36
37	### Step 4: Operationalize
38
39	Stage the Zeek script or scheduled log query as a durable detection.
40
41	## Validation
42
43	- The analyzer parses both TSV (`#fields`) and JSON Zeek logs.
44	- Surfaced anomalies match the chosen log kind's fields.
45	- JA3 rarity and long-connection logic are computed correctly.
46
47	## Pitfalls
48
49	- TSV header (`#fields`) parsing — column order varies by deployment.
50	- Backups/updates producing benign long/large connections.
51	- JA3 collisions across legitimate clients.
52
53	## References
54
55	- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
56	- Zeek docs and log-format references (linked in frontmatter).

People who liked this also viewed

6 picks

Type

azure-kustoQuery and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clustersSkillsJul 2026470k1.3k
lark-base飞书多维表格（Base）操作：建表、字段、记录、视图、统计、公式/lookup、表单、仪表盘、workflow、角色权限；遇到 Base/多维表格/bitable 或 /base/ 链接时使用。文件导入转 lark-drive，认证/授权转 lark-shared。SkillsJul 2026382k16k
lark-calendar飞书日历：管理日历日程和会议室。查看/搜索日程、创建/更新日程、管理参会人、查询忙闲和推荐时段、预定会议室。当用户需要查看日程安排、创建/修改会议、查询/预定会议室时使用。不负责：查询过去的视频会议记录（走 lark-vc）、待办任务（走 lark-task）。SkillsJul 2026380k16k
shadcnManages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. AppliSkillsJul 2026246k120k
xlsxUse this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.SkillsJul 2026139k163k
firebase-data-connectAgent Skills for FirebaseSkillsJul 2026108k387

building-zeek-analytics-for-hunting

18stars5forks

View on GitHub

How to install building-zeek-analytics-for-hunting?

meltedinhex/analyst-ai-pack/building-zeek-analytics-for-hunting

$npx -y skills add meltedinhex/analyst-ai-pack --skill building-zeek-analytics-for-hunting

Installs into the current project.

Summary

Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs

Files · 1

View on GitHub

SKILL.md

1	# Building Zeek Analytics for Hunting
2
3	## When to Use
4
5	- You have Zeek logs (conn.log, dns.log, http.log, ssl.log, files.log) and want to build hunting
6	analytics: long-lived connections, rare JA3 fingerprints, suspicious file downloads, and
7	beaconing.
8	- You want repeatable detections expressed as Zeek scripts or log-analysis queries.
9
10	Do not use Zeek to actively probe hosts — it is passive analysis of captured/sensor traffic.
11
12	## Prerequisites
13
14	- Zeek logs in TSV or JSON (or a running Zeek sensor). The script analyzes exported logs.
15
16	## Workflow
17
18	### Step 1: Analyze a Zeek log for anomalies
19
20	```bash
21	python scripts/analyst.py analyze conn.log --kind conn
22	```
23
24	For `conn`, surfaces long-duration and high-byte connections; for `ssl`, counts JA3 rarity; for
25	`http`, flags executable/script downloads and rare user-agents; for `dns`, flags long/high-entropy
26	queries.
27
28	### Step 2: Express the logic as a Zeek script (optional)
29
30	Translate a confirmed pattern into a Zeek script using the appropriate event
31	(`connection_state_remove`, `ssl_established`, `http_reply`).
32
33	### Step 3: Confirm
34
35	Corroborate anomalies with destination reputation and other logs (pivot by `uid`).
36
37	### Step 4: Operationalize
38
39	Stage the Zeek script or scheduled log query as a durable detection.
40
41	## Validation
42
43	- The analyzer parses both TSV (`#fields`) and JSON Zeek logs.
44	- Surfaced anomalies match the chosen log kind's fields.
45	- JA3 rarity and long-connection logic are computed correctly.
46
47	## Pitfalls
48
49	- TSV header (`#fields`) parsing — column order varies by deployment.
50	- Backups/updates producing benign long/large connections.
51	- JA3 collisions across legitimate clients.
52
53	## References
54
55	- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
56	- Zeek docs and log-format references (linked in frontmatter).

People who liked this also viewed

6 picks

Type