One Weird Trick for Reviewing Zeek Logs on the Command Line!

Are you a network security monitoring dinosaur like me? Do you prefer to inspect your Zeek logs using the command line instead of a Web-based SIEM? If yes, try this one weird trick! I store my Zeek logs in JSON format. Sometimes I like to view the output using jq. If I need to search directories ...

FreeBSD : zeek -- Various vulnerabilities (e333084c-9588-4eee-8bdc-323e02cb4fe0)

Jon Siwek of Corelight reports : This release fixes the following security issues : - Fix potential DNS analyzer stack overflow - Fix potential NetbiosSSN analyzer stack overflow C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBS...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

CVE-2020-5902 F5 BIG-IP devices Summary: A Zeek detec...

zeek -- Various vulnerabilities

Jon Siwek of Corelight reports: This release fixes the following security issues: Fix potential DNS analyzer stack overflow Fix potential NetbiosSSN analyzer stack overflow...

FreeBSD : zeek -- Various vulnerabilities (9f7ae7ea-da93-4f86-b257-ba76707f6d5d)

Jon Siwek of Corelight reports : This release fixes the following security issues : - Fix potential stack overflow in NVT analyzer - Fix NVT analyzer memory leak from multiple telnet authn name options - Fix multiple content-transfer-encoding headers causing a memory leak - Fix potential leak of...

FreeBSD : zeek -- Various vulnerabilities (1a6b7641-aed2-4ba1-96f4-c282d5b09c37)

Jon Siwek of Corelight reports : This release fixes the following security issues : - Fix buffer over-read in Ident analyzer - Fix SSL scripting error leading to uninitialized field access and memory leak - Fix POP3 analyzer global buffer over-read - Fix potential stack overflows due to use of...

zeek -- Various vulnerabilities

Jon Siwek of Corelight reports: This release fixes the following security issues: Fix buffer over-read in Ident analyzer Fix SSL scripting error leading to uninitialized field access and memory leak Fix POP3 analyzer global buffer over-read Fix potential stack overflows due to use of...

zeek -- Various vulnerabilities

Jon Siwek of Corelight reports: This release fixes the following security issues: Fix potential stack overflow in NVT analyzer Fix NVT analyzer memory leak from multiple telnet authn name options Fix multiple content-transfer-encoding headers causing a memory leak Fix potential leak of Analyzers...

FreeBSD : zeek -- Remote crash vulnerability (f59c4c53-c55f-43fe-9920-82b9d1ea9c3d)

Jon Siwek of Corelight reports : This release fixes the following security issue : - An attacker can crash Zeek remotely via crafted packet sequence. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

zeek -- Remote crash vulnerability

Jon Siwek of Corelight reports: This release fixes the following security issue: An attacker can crash Zeek remotely via crafted packet sequence...

FreeBSD : zeek -- potential denial of service issues (4ae135f7-85cd-4c32-ad94-358271b31f7f)

Jon Siwek of Corelight reports : This release addresses the following security issues : - Potential Denial of Service due to memory leak in DNS TSIG message parsing. - Potential Denial of Service due to memory leak or assertion when compiling with assertions enabled when receiving a second SSH KE...

zeek -- potential denial of service issues

Jon Siwek of Corelight reports: This release addresses the following security issues: Potential Denial of Service due to memory leak in DNS TSIG message parsing. Potential Denial of Service due to memory leak or assertion when compiling with assertions enabled when receiving a second SSH KEX...

RITA - Real Intelligence Threat Analytics

RITA is an open source framework for network traffic analysis. The framework ingests Bro/Zeek Logs in TSV format, and currently supports the following major features: Beaconing Detection : Search for signs of beaconing behavior in and out of your network DNS Tunneling Detection Search for signs o...

Zeek - A Powerful Network Analysis Framework That Is Much Different From The Typical IDS You May Know

A powerful framework for network traffic analysis and security monitoring. Key Features — Documentation — Getting Started — Development — License Follow us on Twitter at @zeekurity. Key Features In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis ...

Malcolm - A Powerful, Easily Deployable Network Traffic Analysis Tool Suite For Full Packet Capture Artifacts (PCAP Files) And Zeek Logs

Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files and Zeek formerly Bro logs. These artifacts can be uploaded via a simple browser-based interface or...

CVE-2019-12175

In Zeek Network Security Monitor formerly known as Bro before 2.6.2, a NULL pointer dereference in the Kerberos aka KRB protocol parser leads to DoS because a case-type index is mishandled...

CVE-2019-12175

In Zeek Network Security Monitor formerly known as Bro before 2.6.2, a NULL pointer dereference in the Kerberos aka KRB protocol parser leads to DoS because a case-type index is mishandled...

Null pointer dereference

In Zeek Network Security Monitor formerly known as Bro before 2.6.2, a NULL pointer dereference in the Kerberos aka KRB protocol parser leads to DoS because a case-type index is mishandled...

CVE-2019-12175

In Zeek Network Security Monitor formerly known as Bro before 2.6.2, a NULL pointer dereference in the Kerberos aka KRB protocol parser leads to DoS because a case-type index is mishandled...

UBUNTU-CVE-2019-12175

In Zeek Network Security Monitor formerly known as Bro before 2.6.2, a NULL pointer dereference in the Kerberos aka KRB protocol parser leads to DoS because a case-type index is mishandled...