Network Security Monitoring with Zeek

Zeek is an open-source network intrusion detection system and a network traffic analyzer that uses a domain-specific scripting language. With Zeek you can detect suspicious signatures and anomalies, track DNS, HTTP, and FTP activity. This tool is capable of automatically downloading suspicious files it spots on the network, sending them for analysis, notifying relevant parties if anything is uncovered, blacklisting the source and shutting down the device that downloaded it. In this path, you will learn how to utilize Zeek in your environment to detect intrusions and anomalies.