skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-network-anomalies-with-zeek

Deploys and configures Zeek to passively monitor network traffic and detect anomalies with custom scripts.

954|172|Updated Mar 13, 2026
Search Tags:#anomaly detection#threat hunting#network monitoring#beaconing#siem#zeek#dns tunneling
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-network-anomalies-with-zeek
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-network-anomalies-with-zeek
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/detecting-network-anomalies-with-zeek
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-network-anomalies-with-zeek

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams lack passive, protocol-level visibility into network traffic, making it hard to detect DNS tunneling, C2 beaconing, and other threats that signature-based IDS tools miss.

Core Features & Use Cases

  • Zeek Deployment & Configuration: Install Zeek, configure monitoring interfaces, disable NIC offloading, and define local networks for accurate passive capture.
  • Custom Detection Scripts: Write Zeek scripts for DNS tunneling and beaconing detection using the Notice and SumStats frameworks.
  • Threat Hunting & SIEM Integration: Query conn.log, dns.log, http.log, and ssl.log with zeek-cut, then forward JSON logs to Elasticsearch via Filebeat.
  • Use Case: A SOC analyst deploys Zeek on a network tap at the internet egress point, loads a beacon-detection script, and identifies a compromised host making 60-second-interval HTTPS connections to an external C2 server.

Quick Start

Ask the AI to help you install Zeek on a monitoring interface and write a custom script that detects DNS tunneling and beaconing in your network traffic.

Frequently Asked Questions about detecting-network-anomalies-with-zeek

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DNS tunneling with Zeek?▼

Write a Zeek script that hooks the dns_request event and raises a Notice when query length exceeds a threshold or a source sends too many queries in a time window. Load it in local.zeek, run zeekctl deploy, and check notice.log for DNS_Tunneling_Detected alerts.

How to detect C2 beaconing in Zeek conn.log?▼

Use the SumStats framework to count connections per source-destination pair over an observation window and alert when a threshold is crossed. For low-and-slow beacons, score inter-connection interval regularity instead of fixed counts, or analyze logs with RITA.

Can Zeek inspect encrypted TLS or DNS-over-HTTPS traffic?▼

Zeek cannot decrypt encrypted payloads, so DoH/DoT and TLS beacons leave no dns.log or http.log content. Pivot to ssl.log metadata such as JA3 fingerprints, server_name, and certificate validation status, plus conn.log timing and byte-asymmetry patterns.

Why is Zeek missing packets or showing intermittent beacons?▼

Packet loss usually comes from NIC offloading or an oversubscribed SPAN port. Disable GRO/LRO/TSO with ethtool, check capture_loss.log and zeekctl netstats for drops, and verify Site::local_nets in networks.cfg matches your actual subnets.

When should I not use Zeek for network monitoring?▼

Zeek is passive and cannot block traffic, so it is not a replacement for inline IDS/IPS. It also cannot inspect encrypted payloads without TLS interception, and host-based agents are more appropriate for endpoint-level visibility.

Related Skills

Explore More Software Engineering Skills→
BagelHoleBagelHole
46

aws-vpc

Design and implement AWS VPC networking with subnets, route tables, and security groups.

Community
Intermediate
GhostPWNGhostPWN
4

CSOC Operations & Playbook Automation

Automate SOC alert triage and shift reporting with Python scripts.

Official
Advanced
riparinoriparino
1

defensive-threat-intelligence

Enrich and correlate threat intel data to surface actionable indicators for SOC operations.

Community
Advanced
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced