Zeek: OpenSOC CTF Tool Demo
Shows how to analyze network traffic, extract protocol metadata, and identify malicious connections using Zeek in OpenSOC.
Summary
Network Security Monitoring with Zeek
Zeek converts raw network packets into structured, transaction-level log streams, providing deep protocol visibility without the overhead of full packet capture storage.
Extracting Metadata in OpenSOC Investigations
The demonstration shows how to inspect Zeek connection, DNS, HTTP, and SSL logs to trace malicious traffic flows and spot command-and-control communications during the CTF.
Custom Scripting and Detection Logic
Defenders learn how to leverage Zeek's event-driven scripting language to parse custom protocols, extract file hashes on the wire, and automate alert generation.
Related talks
Blue Team Village·32 min
Josh
Explains how to write, tune, and inspect Suricata intrusion detection signatures to identify exploit traffic in OpenSOC.
Blue Team Village·31 min
Charles Rumford
Charles Rumford challenges overly complex network security designs, showing how simplifying routing and segmentation enhances defensive posture.
Blue Team Village·24 min
Drimacus
Drimacus presents research on operating passive Next-Generation Firewalls (NGFWs) alongside existing detection stacks to enhance network threat hunting and visibility.