Zeek Explained | TryHackMe Zeek P1 & P2 & P3

If you’re doing network forensics or running a SOC lab, this TryHackMe walkthrough is a tidy primer on getting value from Zeek. It covers what Zeek is, how it runs (live service vs offline PCAP analysis), and why its log-first approach is so useful for NSM.

Quick highlights

Zeek is a passive, log-focused network traffic analyzer built for security monitoring and forensic investigation.
Two main operating modes: live network monitoring (deployed on a tap/span) and offline PCAP analysis (zeek -C -r sample.pcap).
Core logs to watch: conn.log (connection summaries), http.log, dns.log, ssl.log, plus detection logs like signatures.log and notice.log.
Detection pattern: signatures detect payload/protocol patterns → generate events/notices → correlate via UID across logs → trigger ZeekScript actions.

Practical starter checklist

Deploy Zeek on a span/tap for continuous visibility; store logs under /opt/zeek/logs/current (default).
Prioritize ingesting conn.log, dns.log, http.log, ssl.log into your pipeline (ELK/Splunk) for quick triage.
Write signatures for obvious IOCs (regex payload matches) and use ZeekScript to escalate or enrich events.
Correlate by UID , this lets you pivot from a suspicious DNS or HTTP hit to the full connection context.
Test offline: capture PCAPs from red-team exercises and run zeek -C -r to validate detections and tune signatures.