Menu

Individual skill

detecting-network-anomalies-with-zeek

0upvotes

Deploys and configures Zeek (formerly Bro) network security monitor to passively analyze network traffic, generate structured logs, detect anomalous behavior, and create custom detection scripts for threat hunting and incident response.

internal/tools/skills/data/network-security/detecting-network-anomalies-with-zeek/SKILL.md

Read pinned source

Source commit d42f381ad34843e71a42658e5c57290c713e85af

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,329
Repository last updated
Nov 9, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt
# Detecting Network Anomalies with Zeek

## When to Use

- Deploying passive network security monitoring at key network choke points for continuous visibility
- Generating structured connection, DNS, HTTP, SSL, and file transfer logs for SIEM ingestion and threat hunting
- Writing custom Zeek scripts to detect organization-specific threats, policy violations, or beaconing behavior
- Performing retrospective analysis on network metadata to investigate security incidents
- Complementing IDS solutions with protocol-level metadata analysis that signature-based tools may miss

**Do not use** as a replacement for inline IDS/IPS that can actively block traffic, for monitoring encrypted payloads without TLS inspection, or on endpoints where host-based agents are more appropriate.

## Detection Gaps & Validation

- **SPAN/tap drops create silent blind spots:** an oversubscribed mirror or NIC offload (GRO/LRO reassembly) makes Zeek miss frames, so beacons look intermittent. Confirm `ethtool -k eth1` shows offloads `off`, check `capture_loss.log` / `zeekctl netstats` for drops, and verify the `Site::local_nets` in `networks.cfg` actually match your subnets or every internal/external test breaks.
Back to top