DISCOVER ZEEK DATA

Zeek's conn.log provides foundational data about every connection on your network—the who, what, when, and where of your packets. It allows network and security teams to find unusual flows, unexpected protocols, policy-prohibited connections, and more, and it includes a UID for pivoting straight into the Layer 7 details. Watch conn.log video.

uid
A unique identifier created on a per-connection basis that serves as a pivot key directly into all associated Layer 7 logs

service
The Layer 7 protocol detected on the connection—based on packet payload instead of port mappings

orig_bytes/resp_bytes
How much data was sent and received on the connection

duration
How long the connection remained alive

Zeek's dns.log makes a much bigger impact than typical DNS logs—providing not just the query string and type, but also the returned addresses and server status code. The level of detail in the dns.log allows for easy follow-up on suspicious queries, without having to pivot to another data set.

answers
A list of all domain names and/or IP addresses sent back by the DNS server

qtype_name
Type of query being issued—IPv4, IPv6, mail, CNAME, etc

query
The name being looked up by your monitored device

rcode_name
Human-readable server respose codes, such as NXDOMAIN or NOERROR

The corelight_suricata.log gives you a full breakdown of IDS signatures that alert in your environment. They're directly integrated with Zeek metadata by way of the UID, which allows analysts to get all the evidence they need to evaluate alerts in a single pivot.

alert_signature
Description of what the signature is detecting

alert.metadata
Details about the signature, including age, deployment recommendations, impacted software, etc

alert.category
Type of activity being detected, such as administrator account compromise, known malware, or policy violation

alert.signature_id
Numeric ID to identify the source of the signature and pivot to its detection criteria for validation