4 ms·

It might be the world's most popular thingamabob but I never heard of it.

ketzu 4y ago
> Zeek (formerly Bro) People that encountered network security probably know the name "Bro" much better. Apparently they rebranded in 2018. Wikipedia has the following to say about it: > Dr. Paxson originally named the software "Bro" as a warning regarding George Orwell's Big Brother from the novel Nineteen Eighty-Four. In 2018 the project leadership team decided to rename the software. At LBNL in the 1990s, the developers ran their sensors as a pseudo-user named “zeek”, thereby inspiring the name change in 2018.
- hdjjhhvvhga 4y ago
  Bro is definitely popular, but I wonder where they got the "world’s most popular network security monitoring platform" phrase from.
  - Beached 4y ago
    because it's probably the world's most popular security monitoring platform? it's been around for a long time, it does it's job very well, and it's available in whatever flavor of implementation difficulty you want. from completely free roll yourself, to easy to deploy via push button with thousands of detections already to go for you. even most of the enterprise solutions sold for network monitoring proudly boast that they use bro under the hood for their stream parsing engine.
    - hdjjhhvvhga 4y ago
      > probably I agree, and I'd like to understand the reason why "probably" disappeared from the press release. If you claim something, you should be able to back it up with some numbers, right? I'm a big fan of Bro and fully agree with the "leading solution" or "everybody is using it" phrases, I just miss the data that would make it the number one.
  - nemo44x 4y ago
    Everyone uses it. Gov/Military deploy it everywhere and I’d estimate most of the Fortune 1000 does too.
    - josteink 4y ago
      I’ve never heard of anyone anywhere using such software. In Europe it might even be illegal? Could your POV be somewhat US-centric?
      - nemo44x 4y ago
        I’ve been a part of teams that have sold tons of it to European governments and corporations. Anything the US Department of Defense uses has a great chance of being used across Europe. We train Euro militaries on how to use these tools.
    - hdjjhhvvhga 4y ago
      > Everyone uses it. I hear this phrase about many software platforms. That's why I'd like to see some numbers before someone uses an absolute qualifier. I have no idea how popular is Zeek against OSSEC, Suricata or Snort these days, I'm just wary of claiming something without providing any justification.
      - tptacek 4y ago
        I think the real issue here is that things like Snort, Suricata, and Zeek are just not very popular as a class of security thingy anymore. Certainly, for the last 10 years or so, I'd have advised most startups I worked with against deploying anything like them. There was, in the long-long-ago, a huge industry debate about whether detection and response was best done in the network or on the endpoint. That debate has been settled: most places deploy EDR, and few places deploy IPS.
        nemo44x 4y ago
        The DoD would beg to differ. EDR is a huge business indeed but often network monitoring is used in conjunction. Also startups make up almost nothing of the ecosystem. Fortune 1000 and Gov have millions of different departments that have their own requirements.
- ThaDood 4y ago
  Other "fun" fact. I went to a B-Sides conference where one of the higher ups from the Bro Platform talked about how they had to purchase the domain from a fraternity. Zeek is cool but I always thought Bro was a neat name for a sec product.
  - ethbr0 4y ago
    It's funny how it was named ironically / in caution, and subsequently changed. I wonder how long until Palantir rebrands...
throwup 4y ago
In a press release, every product mentioned is the world's most popular product (by some very carefully chosen statistic, of course)
- robertlagrant 4y ago
  I'm the most popular husband in my house! Also the least popular.
  - santoshalper 4y ago
    Also the most mediocre.
    - robertlagrant 4y ago
      Clearly you've seen my mug collection.
    - pjc50 4y ago
      A former coworker had a "World's Okayest Dad" mug.
- gw99 4y ago
  Hey at least that’s deniably dishonest. We are tangibly dishonest when we fund a conference in our sector and win best product in the sector every year!
noasaservice 4y ago
Same. I've worked in systems engineering for 10+ years and never even heard of it. I have heard of: Ganglia, nagios, graylog, grafana, science logic and others. And I've used most of them.
- happyopossum 4y ago
  None of those are equivalent to zeek. It’s cohort includes snort, suricata, etc.
- jmbwell 4y ago
  Yeah so Zeek/Bro might be more of an intrusion detection tool, in the vein of snort or suricata, in that it can monitor network traffic and alert on suspicious patterns. It has some things in common with tcpdump or wireshark also, in that it can interpret common protocols for human inspection. As part of Windows, I would speculate it serves a function similar to something like Little Snitch on macOS, but that’s just a guess. Maybe they have something different in mind.
  - lmeyerov 4y ago
    Yeah more of a OSS network traffic inspector for security monitoring. I think it ships with IDS rules nowadays, but we see it generally more for manual impl. We see often fed into Splunk or ELK to feed custom detections, and especially enriching context to simplify investigating alerts by detection tools. Its investment into cross-record correlation IDs make graph-based investigations super effective: you can grab all sessions at an impact period and see them fan out across entities, resources, time, etc! We mostly see it in sec teams in gov + DIY/code-heavy enterprise. Super popular bc those teams have more time to figure out tuned use of the rich low-level data, maybe budget to store it, and OSS means they can avoid the vendor dance. CoreLight, who we did a popular webinar with awhile back showing how to enable rich visual hunting & investigation for the data by combining with Graphistry, is the biggest dedicated vendor building hw/sw to make it all more manageable at scale. So seeing in Windows is probably big news for their community..
- deleted 4y ago
  [deleted]

> Zeek (formerly Bro) People that encountered network security probably know the name "Bro" much better. Apparently they rebranded in 2018. Wikipedia has the following to say about it: > Dr. Paxson originally named the software "Bro" as a warning regarding George Orwell's Big Brother from the novel Nineteen Eighty-Four. In 2018 the project leadership team decided to rename the software. At LBNL in the 1990s, the developers ran their sensors as a pseudo-user named “zeek”, thereby inspiring the name change in 2018.

hdjjhhvvhga 4y ago
Bro is definitely popular, but I wonder where they got the "world’s most popular network security monitoring platform" phrase from.
- Beached 4y ago
  because it's probably the world's most popular security monitoring platform? it's been around for a long time, it does it's job very well, and it's available in whatever flavor of implementation difficulty you want. from completely free roll yourself, to easy to deploy via push button with thousands of detections already to go for you. even most of the enterprise solutions sold for network monitoring proudly boast that they use bro under the hood for their stream parsing engine.
  - hdjjhhvvhga 4y ago
    > probably I agree, and I'd like to understand the reason why "probably" disappeared from the press release. If you claim something, you should be able to back it up with some numbers, right? I'm a big fan of Bro and fully agree with the "leading solution" or "everybody is using it" phrases, I just miss the data that would make it the number one.
- nemo44x 4y ago
  Everyone uses it. Gov/Military deploy it everywhere and I’d estimate most of the Fortune 1000 does too.
  - josteink 4y ago
    I’ve never heard of anyone anywhere using such software. In Europe it might even be illegal? Could your POV be somewhat US-centric?
    - nemo44x 4y ago
      I’ve been a part of teams that have sold tons of it to European governments and corporations. Anything the US Department of Defense uses has a great chance of being used across Europe. We train Euro militaries on how to use these tools.
  - hdjjhhvvhga 4y ago
    > Everyone uses it. I hear this phrase about many software platforms. That's why I'd like to see some numbers before someone uses an absolute qualifier. I have no idea how popular is Zeek against OSSEC, Suricata or Snort these days, I'm just wary of claiming something without providing any justification.
    - tptacek 4y ago
      I think the real issue here is that things like Snort, Suricata, and Zeek are just not very popular as a class of security thingy anymore. Certainly, for the last 10 years or so, I'd have advised most startups I worked with against deploying anything like them. There was, in the long-long-ago, a huge industry debate about whether detection and response was best done in the network or on the endpoint. That debate has been settled: most places deploy EDR, and few places deploy IPS.
      - nemo44x 4y ago
        The DoD would beg to differ. EDR is a huge business indeed but often network monitoring is used in conjunction. Also startups make up almost nothing of the ecosystem. Fortune 1000 and Gov have millions of different departments that have their own requirements.
ThaDood 4y ago
Other "fun" fact. I went to a B-Sides conference where one of the higher ups from the Bro Platform talked about how they had to purchase the domain from a fraternity. Zeek is cool but I always thought Bro was a neat name for a sec product.
- ethbr0 4y ago
  It's funny how it was named ironically / in caution, and subsequently changed. I wonder how long until Palantir rebrands...

throwup 4y ago

In a press release, every product mentioned is the world's most popular product (by some very carefully chosen statistic, of course)

robertlagrant 4y ago
I'm the most popular husband in my house! Also the least popular.
- santoshalper 4y ago
  Also the most mediocre.
  - robertlagrant 4y ago
    Clearly you've seen my mug collection.
  - pjc50 4y ago
    A former coworker had a "World's Okayest Dad" mug.
gw99 4y ago
Hey at least that’s deniably dishonest. We are tangibly dishonest when we fund a conference in our sector and win best product in the sector every year!

noasaservice 4y ago

Same. I've worked in systems engineering for 10+ years and never even heard of it. I have heard of: Ganglia, nagios, graylog, grafana, science logic and others. And I've used most of them.

happyopossum 4y ago
None of those are equivalent to zeek. It’s cohort includes snort, suricata, etc.
jmbwell 4y ago
Yeah so Zeek/Bro might be more of an intrusion detection tool, in the vein of snort or suricata, in that it can monitor network traffic and alert on suspicious patterns. It has some things in common with tcpdump or wireshark also, in that it can interpret common protocols for human inspection. As part of Windows, I would speculate it serves a function similar to something like Little Snitch on macOS, but that’s just a guess. Maybe they have something different in mind.
- lmeyerov 4y ago
  Yeah more of a OSS network traffic inspector for security monitoring. I think it ships with IDS rules nowadays, but we see it generally more for manual impl. We see often fed into Splunk or ELK to feed custom detections, and especially enriching context to simplify investigating alerts by detection tools. Its investment into cross-record correlation IDs make graph-based investigations super effective: you can grab all sessions at an impact period and see them fan out across entities, resources, time, etc! We mostly see it in sec teams in gov + DIY/code-heavy enterprise. Super popular bc those teams have more time to figure out tuned use of the rich low-level data, maybe budget to store it, and OSS means they can avoid the vendor dance. CoreLight, who we did a popular webinar with awhile back showing how to enable rich visual hunting & investigation for the data by combining with Graphistry, is the biggest dedicated vendor building hw/sw to make it all more manageable at scale. So seeing in Windows is probably big news for their community..
deleted 4y ago
[deleted]