3 ms·

Same. I've worked in systems engineering for 10+ years and never even heard of it. I have heard of: Ganglia, nagios, graylog, grafana, science logic and others

Same. I've worked in systems engineering for 10+ years and never even heard of it. I have heard of: Ganglia, nagios, graylog, grafana, science logic and others. And I've used most of them.

happyopossum 4y ago
None of those are equivalent to zeek. It’s cohort includes snort, suricata, etc.
jmbwell 4y ago
Yeah so Zeek/Bro might be more of an intrusion detection tool, in the vein of snort or suricata, in that it can monitor network traffic and alert on suspicious patterns. It has some things in common with tcpdump or wireshark also, in that it can interpret common protocols for human inspection. As part of Windows, I would speculate it serves a function similar to something like Little Snitch on macOS, but that’s just a guess. Maybe they have something different in mind.
- lmeyerov 4y ago
  Yeah more of a OSS network traffic inspector for security monitoring. I think it ships with IDS rules nowadays, but we see it generally more for manual impl. We see often fed into Splunk or ELK to feed custom detections, and especially enriching context to simplify investigating alerts by detection tools. Its investment into cross-record correlation IDs make graph-based investigations super effective: you can grab all sessions at an impact period and see them fan out across entities, resources, time, etc! We mostly see it in sec teams in gov + DIY/code-heavy enterprise. Super popular bc those teams have more time to figure out tuned use of the rich low-level data, maybe budget to store it, and OSS means they can avoid the vendor dance. CoreLight, who we did a popular webinar with awhile back showing how to enable rich visual hunting & investigation for the data by combining with Graphistry, is the biggest dedicated vendor building hw/sw to make it all more manageable at scale. So seeing in Windows is probably big news for their community..
deleted 4y ago
[deleted]

Same. I've worked in systems engineering for 10+ years and never even heard of it. I have heard of: Ganglia, nagios, graylog, grafana, science logic and others. And I've used most of them.

happyopossum 4y ago

None of those are equivalent to zeek. It’s cohort includes snort, suricata, etc.

jmbwell 4y ago

Yeah so Zeek/Bro might be more of an intrusion detection tool, in the vein of snort or suricata, in that it can monitor network traffic and alert on suspicious patterns. It has some things in common with tcpdump or wireshark also, in that it can interpret common protocols for human inspection. As part of Windows, I would speculate it serves a function similar to something like Little Snitch on macOS, but that’s just a guess. Maybe they have something different in mind.

lmeyerov 4y ago
Yeah more of a OSS network traffic inspector for security monitoring. I think it ships with IDS rules nowadays, but we see it generally more for manual impl. We see often fed into Splunk or ELK to feed custom detections, and especially enriching context to simplify investigating alerts by detection tools. Its investment into cross-record correlation IDs make graph-based investigations super effective: you can grab all sessions at an impact period and see them fan out across entities, resources, time, etc! We mostly see it in sec teams in gov + DIY/code-heavy enterprise. Super popular bc those teams have more time to figure out tuned use of the rich low-level data, maybe budget to store it, and OSS means they can avoid the vendor dance. CoreLight, who we did a popular webinar with awhile back showing how to enable rich visual hunting & investigation for the data by combining with Graphistry, is the biggest dedicated vendor building hw/sw to make it all more manageable at scale. So seeing in Windows is probably big news for their community..

deleted 4y ago

[deleted]