PUT EVERYTHING IN CONTEXT
For decades, the world's best defenders have relied on Zeek network data. Comprised of dozens of logs for varied protocols, plus extracted files, Zeek data is a vital resource for evidence-based defenders as they seek to speed response, amplify hunting, and more, across on-prem, hybrid, and cloud environments.
Corelight has merged the power of Zeek with a suite of enterprise features that dramatically improve Zeek usability, like an intuitive management UI, sensor health metrics, fleet management, and automated data export to Splunk, Elastic, Kafka, Syslog, and S3. Take Zeek on prem, to the cloud, and beyond with Corelight Sensors.
Complete, connected, customizable
Fittingly, Zeek’s superpower is connection. As it monitors and records network activity, Zeek assigns a unique connection ID (UID) that links all the logs associated with each connection, while its Community ID connects network flows across data sets, regardless of the tool that produced them.
Zeek is open source and gives you an exceptional amount of control over what you monitor, and where that data goes. You can even write your own parsers, with help from Corelight.
View Zeek data
Zeek's conn.log provides foundational data about every connection on your network—the who, what, when, and where of your packets. It allows network and security teams to find unusual flows, unexpected protocols, policy-prohibited connections, and more, and it includes a UID for pivoting straight into the Layer 7 details. Watch conn.log video.
A unique identifier created on a per-connection basis that serves as a pivot key directly into all associated Layer 7 logs
The Layer 7 protocol detected on the connection—based on packet payload instead of port mappings
How much data was sent and received on the connection
How long the connection remained alive
Zeek's dns.log makes a much bigger impact than typical DNS logs—providing not just the query string and type, but also the returned addresses and server status code. The level of detail in the dns.log allows for easy follow-up on suspicious queries, without having to pivot to another data set.
A list of all domain names and/or IP addresses sent back by the DNS server
Type of query being issued—IPv4, IPv6, mail, CNAME, etc
The name being looked up by your monitored device
Human-readable server respose codes, such as NXDOMAIN or NOERROR
The corelight_suricata.log gives you a full breakdown of IDS signatures that alert in your environment. They're directly integrated with Zeek metadata by way of the UID, which allows analysts to get all the evidence they need to evaluate alerts in a single pivot.
Description of what the signature is detecting
Details about the signature, including age, deployment recommendations, impacted software, etc
Type of activity being detected, such as administrator account compromise, known malware, or policy violation
Numeric ID to identify the source of the signature and pivot to its detection criteria for validation