Free readiness test
Home / Tool labs / Zeek

Zeek hands-on lab Where did the data go?

Turn raw traffic into rich, searchable logs for threat hunting.

NetworkIntermediatePro live lab5 objectives
hunter@zeek-sensor:/zeek/2026-11-08$
$ cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes | sort -k4 -nr | head
10.10.40.12   203.0.113.45   443   28812.4   2148007231
10.10.40.12   52.97.146.162  443   9020.11    1840021
10.10.12.30   140.82.112.21  443   3301.92    921004
10.10.40.88   10.10.0.20     445   2210.40    48213
columns: src  dst  port  duration(s)  bytes_sent
10.10.40.12 sent 2.1 GB over an 8-hour connection to an unknown IP. Normal user traffic downloads more than it uploads.

What is Zeek?

Zeek (formerly Bro) is a network security monitor. Instead of alerting on signatures, it writes structured logs of every connection, DNS query, HTTP request and TLS handshake, which makes it perfect for hunting.

1 Logs, not alerts

conn.log, dns.log, http.log, ssl.log and more describe everything that happened on the network.

2 zeek-cut

Extracts the columns you need so you can sort, count and pivot with standard Linux tools.

3 Hunting by behaviour

Long connections, huge uploads, odd DNS and invalid certificates reveal attacks that signatures miss.

The scenario: Where did the data go?

Finance reports that a confidential M&A file appeared on a leak site. You have 24 hours of Zeek logs from the core switch tap in /zeek/2026-11-08/. Hunt for signs of data exfiltration.

Run this lab live in the platform

A simulated terminal with 5 objectives, hints and scenario questions. Included with NERvE Pro.

Open the Zeek lab

Step-by-step: Zeek commands used in this lab

1List the available Zeek logs

Just list the directory.

ls

2Find the longest connections and the bytes they sent

zeek-cut the duration and byte columns, then sort by duration.

cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration orig_bytes | sort -k4 -nr | head

3Look for unusual DNS: most-queried domains

zeek-cut the query column from dns.log, then count.

cat dns.log | zeek-cut query | sort | uniq -c | sort -nr | head

4Check the TLS certificate of the exfiltration server

ssl.log: server_name, validation_status, subject.

cat ssl.log | zeek-cut id.resp_h server_name validation_status subject

5Review Zeek's notices

notice.log holds Zeek's own findings.

cat notice.log | zeek-cut note msg src dst

Key takeaways

Install Zeek and practise for real

docker run --rm -v $PWD:/pcap zeek/zeek zeek -r /pcap/sample.pcap

Run Zeek on a sample pcap and explore the logs it creates in the current folder. Only scan or test systems you own or are explicitly authorised to assess. Official site: zeek.org · Licence: BSD.

Scenario questions

Which internal host exfiltrated data?

Answer: 10.10.40.12. 10.10.40.12 sent 2.1 GB to 203.0.113.45 over 8 hours and also made thousands of tunnelled DNS queries.

What's the giveaway for DNS tunnelling?

Answer: Thousands of long, random, unique subdomains under one domain. Encoded data in subdomain labels produces huge numbers of unique, random-looking names.

How is Zeek different from an IDS like Suricata?

Answer: It records detailed logs of all activity for hunting, rather than mainly alerting on signatures. Zeek is a network security monitor; it complements signature IDS with behavioural visibility.

More open-source tool labs

📡

Nmap

Discover hosts, open ports and services on networks you're authorised to assess.

🦈

Wireshark / tshark

See exactly what's crossing the wire and spot malware calling home.

🚨

Suricata

Detect attacks in network traffic with signatures, and write your own.

🛡️

Wazuh

An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.

Σ

Sigma

Write a detection once, run it in any SIEM.

🧬

YARA

Describe malware by its patterns and hunt for it across files.