# Zeek Newsletter - Issue 16 - February - March 2022 **URL:** \ **Category:** Announcements\ **Tags:** newsletter\ **Created:** [March 17, 2022, 5:39pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-16-february-march-2022/6457 "2022-03-17T17:39:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Richard\_Bejtlich](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/richard_bejtlich/32/597_2.png) [@Richard\_Bejtlich](https://community.zeek.org/u/Richard_Bejtlich)\ **Post date:** [March 17, 2022, 5:39pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-16-february-march-2022/6457/1 "2022-03-17T17:39:53Z")
Welcome to the Zeek Newsletter! In this Issue: TL;DR Development Updates Zeek Blog and Mailing List Zeek in the Community Zeek Package Updates Zeek in the Enterprise Upcoming Events Zeek Related Jobs Get Involved TL;DR A lot has happened since issue 15, so this newsletter captures as much of that development as possible. The biggest news involves a vulnerability in OpenSSL, as addressed next. Development Updates On March 16, Johanna Amann noted that Zeek was affected by CVE-2022-0778, a vulnerability in OpenSSL. The OpenSSL advisory is here: [https://www.openssl.org/news/secadv/20220315.txt](https://www.openssl.org/news/secadv/20220315.txt) Johnna notes: “A Zeek process will hang when parsing traffic that contains a malicious certificate that is aimed to exploit this vulnerability. Updating to patched versions of OpenSSL, and restarting Zeek, will fix this issue.” In a Twitter thread, Johanna noted that Zeek “can detect exploitation attempts using this script that was originally written for a different exploit in 2020 that had a similar-ish mechanic:” > **[GitHub - 0xxon/cve-2020-0601: Zeek package to detect CVE-2020-0601](https://github.com/0xxon/cve-2020-0601)** > > Zeek package to detect CVE-2020-0601 For more information, see Johanna’s Twitter thread: [https://twitter.com/0xxon/status/1504188199731671040](https://twitter.com/0xxon/status/1504188199731671040) On March 11, Benjamin Bannier released Spicy 1.4.0. Developers can leverage Spicy to more easily create new protocol parsers. See the NEWS file for a high-level summary: > See the CHANGES file for a detailed list of changes that went into this release. > To take full advantage of the new features in this release, spicy-plugin-1.3.8 is required: > **[Zeek Package Manager: Packages](https://packages.zeek.org/packages/view/cfa999bc-9348-11eb-81e7-0a598146b5c6)** Zeek Blog and Mailing List In addition to discussions of the OpenSSL vulnerability and the Spicy release, the mailing list was fairly active since the last newsletter. This discussion offered thoughts on how Zeek creates timestamps in the connection log: [https://lists.zeek.org/archives/list/zeek@lists.zeek.org/thread/7KT2H7WY222SJJDZ56LZUWFOQA32GIIN/](https://lists.zeek.org/archives/list/zeek@lists.zeek.org/thread/7KT2H7WY222SJJDZ56LZUWFOQA32GIIN/) This thread talked about ways to only create the DNS log: [https://lists.zeek.org/archives/list/zeek@lists.zeek.org/thread/PNIYGLJKL2MQPKQLE5PZRFXT6YQXGN62/](https://lists.zeek.org/archives/list/zeek@lists.zeek.org/thread/PNIYGLJKL2MQPKQLE5PZRFXT6YQXGN62/) For now, the project is not updating the blog. For more, see the blog and mailing list archive: > **[Zeek: Blog](https://zeek.org/blog/)** > > Visit the post for more. [https://lists.zeek.org/archives/list/zeek@lists.zeek.org/](https://lists.zeek.org/archives/list/zeek@lists.zeek.org/) Zeek in the Community On February 10, Dynamite Analytics released NSM 1.1, which includes Zeek and Suricata, and other capabilities: > **[GitHub - DynamiteAI/dynamite-nsm: DynamiteNSM is a free Network Security Monitor...](https://github.com/DynamiteAI/dynamite-nsm)** > > DynamiteNSM is a free Network Security Monitor developed by Dynamite Analytics to enable network visibility and advanced cyber threat detection On March 2, Fatema Bannat Wala hosted a Zeek community call. The recording is here: [![](https://img.youtube.com/vi/2RAJjiX8HY4/maxresdefault.jpg "Zeek Community Call, 2 March 2022") ](https://www.youtube.com/watch?v=2RAJjiX8HY4) Fatema highlighted the progress made by the Zeek training group on the Zeek Project Approved Training Framework. See this page for details: > **[Zeek: Training](https://zeek.org/training/)** > > Visit the post for more. On March 9, Security Onion solutions released Security Onion 2.3.110, which includes an intrusion detection honeypot: > **[Security Onion 2.3.110 now available including Intrusion Detection Honeypot...](https://blog.securityonion.net/2022/03/security-onion-23110-now-available.html)** > > Security Onion 2.3.110 is now available! It includes new features and resolves a few issues: https://docs.securityonion.net/en/2.3/release-n... Finally, Patrick Kelley continues to release updated threat intelligence feeds formatted for use by Zeek: > **[GitHub - CriticalPathSecurity/Zeek-Intelligence-Feeds: Zeek-Formatted Threat Intelligence Feeds](https://github.com/CriticalPathSecurity/Zeek-Intelligence-Feeds)** > > Zeek-Formatted Threat Intelligence Feeds Zeek Package Updates The following packages reported updates recently as of March 17, via this search: [https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed](https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed) Added mvlnetdev and the zkg.index file #178 by mvlnetdev was merged 17 days ago The packages.zeek.org site reported the following updates as of March 17:     3/15/22, 2:06 PM spicy-plugin     3/15/22, 1:22 PM zeek-agent-v2     3/14/22, 2:51 PM zeek-long-connections     3/9/22, 10:59 AM bzar     3/8/22, 5:34 PM zeek-xor-exe-plugin Zeek in the Enterprise On February 28, Alex Kirk described how to use Zeek and Suricata to detect nation-state digital attacks: > **[Acting on CISA’s Advice for Detecting Russian Cyberattacks | Corelight](https://corelight.com/blog/acting-on-cisas-advice-for-detecting-russian-cyberattacks)** > > This post explores the 4 key areas outlined in the CISA "Shields Up" memo and examines ways they can be detected with network data. The post highlighted the feed of IP addresses that Greynoise had observed attacking its honeypot infrastructure in Ukraine. This Twitter thread has details: [https://twitter.com/Andrew\_\_\_Morris/status/1496986196874043392](https://twitter.com/Andrew___Morris/status/1496986196874043392) ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-16-february-march-2022/6457/2 "2022-05-06T15:47:51Z")