12 Days of Defense - Day 2: How to use Zeek for PCAP Analysis

[@RyanBro]

Remnux is now on 20.04 so look out fellow future people. Thanks for this John.

[@alanmarkkristensen2878]

Fantastic series. You’re great at explaining, and you’re great at picking relevant topics! Can’t wait for tomorrow’s episode!

[@jibraelaryaanentertainment1263]

Excellent video John. Spot on and extremely useful.

[@adivasi6894]

Never knew Zeek, would love to see more...Great job John.

[@Marcrasq]

Well crafted video, super easy to follow, and great explanation of each command cheers.

[@andrew154221]

Dude you saved my freaking life for my lab due tonight, thank you!!!

[@johnvardy9559]

hey john great informations, the puzzle it's a bit big across tcpdump Tshark zeek brim and so on as a beginner you can't clear enough the path and what is that a SOC analyst net for NTA.

[@alexanderjean9784]

Helped me tremendously! Thank you, John.

[@afeefshaikh7876]

10:45 How do you go back and forth between the terminal and the logs? I’m on Windows btw

[@SecHubb]

Nothing fancy, I’m just quitting out of viewing the file with the less command and being taken back to the terminal.

[@Lykos-i2m]

Learned a lot from the video, thanks for sharing your valuable knowledge with the world!

[@hptc4400]

Awesome content... Really appreciated. One question though. Why none of the public IP addresses were in the source address column (id.orig_h) in the conn.log? Does that mean no ingress communication took place or is that of Zeek records it traffic?

[@ibejoe7719]

Kaching....on the money bro job well done thanks

[@dougthebugwrx]

Clear and concise instructions. Awesome thank you .

[@impeccablestudio844]

I am getting the below error in the last step of the process and i havt found any sourse which provides the solutions . Please have a look and let me know if there is anything i can do . "The following packages have unmet dependencies. zeek-core : Depends: libc6 (< 2.28) but 2.35-0ubuntu3 is to be installed Depends: libssl1.1 (>= 1.1.0) but it is not installable E: Unable to correct problems, you have held broken packages. "

[@ipmail2224]

try googling so that you can install from ppa for your distro

[@abdulrahmanbasa8993]

but wich one is better zeek or wireshark?

[@nitaantvyas676]

Are there any cheat sheets of zeek queries?

[@yungskullivan]

Thanks, John! Super helpful.

[@garrettw6145]

Excellent Approach! Super useful!

[@6Karaboudjan9]

how to enable it on fedora

[@gamalielsankaytshiswakamar961]

Outstanding explanation

[@lifechangerstore]

As a blue team, its like earmilk. Very very good.

[@oguzylmaz5188]

Thank you for sharing such kind of invaluable info. I appreciate you.

[@contacthellosew7853]

Perfect Explanation ever! Thank you

[@ManojKumar-yt5ne]

Thanks for your amazing video. Could you please suggest how to use python to capture network data through libpcap or winpcap?

[@AjitKumar-sy9cv]

Again great explanation and good topic.. !!

[@behfarmr6035]

That's great! Thank you very much. Appreciated! How can generate alert instead of logs with Zeek?

[@SecHubb]

For that you’ll want some kind of IDS. Suricata is a great free option for that.

[@sposada00]

This is amazing stuff

[@jayinfosec]

Great videos John!

[@mohamedsaidani8509]

Thanks man ^^ we are waiting for the next one ;)

[@أحمدباسمراضيابومحسن]

What is the password to decrypt the file

[@rezamehrad8512]

Perfect Series!

[@comunidaddojo]

Very good content, thanks for sharing.

[@anasshaikh5778]

Hey can we install zeek in windows subsystem for Linux

[@rckrs-jf8lb]

Excelent information.

[@abdirahmanbadri2943]

helpful tricks and tools thanks allot

[@abhigyanapandey6454]

wanna hear a secret,cap? ur AWESOME

[@kapoof2]

Wow he went X-Games mode at the end.