ZEEK AS AN IDS

Zeek
1

Hello! I am an intermediate zeek user. I would like a walk-through on how i can use zeek to detect different types of attacks such as sql injection, ddos, man in the middle attacks and the likes.
Thanks.

2

Hello,

What research have you done so far?

Richard

3

I just Googled

bro sql injection detection

and this paper was the second result, right after a link to the Bro SQL injection detection script.

https://www.sans.org/reading-room/whitepapers/detection/web-application-attack-analysis-bro-ids-34042

You might have to look for Bro references as the Zeek rename is only a year old.

Sincerely,

Richard

4

Thanks, I’ll check it out.

edX