Corelight Bright Ideas Blog

Featured

Learn how to test Zeek packages without PCAPs by using Zeek logs and the Input Framework to reproduce bugs, analyze historical data, and prevent...

Stories by Yacin

Learn how to test Zeek packages without PCAPs by using Zeek logs and the Input Framework to reproduce bugs, analyze historical data, and prevent...

Learn how to test Zeek packages without shareable PCAPs by hand-crafting BTest events and using Zeek event traces to reliably reproduce network...

Learn how to unit test Zeek packages with BTest and assert statements, using practical examples to catch failures and build more reliable Zeek...

I’ve created and released a Zeek package, zeek-notice-telegram. I’ll walk you through a simple example so you can write your own action.

To assist in detecting Zerologon (CVE-2020-1472), we’ve open sourced a Zeek package that detects both attempted and successful exploits.