# Zeek Newsletter - Issue 17 - April 2022 **URL:** \ **Category:** Announcements\ **Tags:** newsletter\ **Created:** [April 22, 2022, 1:37pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-17-april-2022/6467 "2022-04-22T13:37:20Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Richard\_Bejtlich](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/richard_bejtlich/32/597_2.png) [@Richard\_Bejtlich](https://community.zeek.org/u/Richard_Bejtlich)\ **Post date:** [April 22, 2022, 1:37pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-17-april-2022/6467/1 "2022-04-22T13:37:20Z")
Welcome to the Zeek Newsletter. In this Issue: TL;DR Development Updates Zeek Blog and Mailing List Zeek in the Community Zeek Package Updates Zeek in the Enterprise Upcoming Events Zeek Related Jobs Get Involved TL;DR Please note the security vulnerability in versions of Zeek prior to 4.0.6 and 4.2.1, discussed in Development Updates. Also see the Upcoming Events section for details on free training on May 20. Development Updates On April 21, Tim Wojtulewicz announced the release of Zeek 4.0.6 and Zeek 4.2.1. Both address a security issue. Previous versions of Zeek shipped a vulnerability in the File Transfer Protocol FTP analyzer. If an intruder provided specially-crafted input, Zeek might crash due to a buffer overflow condition. Please update to the new versions of Zeek as soon as possible to mitigate this vulnerability. The Zeek Project would like to thank Jason Ish from the Open Information Security Foundation OISF for reporting this vulnerability. These new versions of Zeek include other fixes as well. See the release notes for details: [Release v4.0.6 · zeek/zeek · GitHub](https://github.com/zeek/zeek/releases/tag/v4.0.6) [Release v4.2.1 · zeek/zeek · GitHub](https://github.com/zeek/zeek/releases/tag/v4.2.1) Binary packages for the new releases will also be available shortly: > **[Binary Packages](https://github.com/zeek/zeek/wiki/Binary-Packages)** > > Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. - zeek/zeek Updated source code is already available: > **[Zeek: Get Zeek](https://zeek.org/get-zeek/)** > > Visit the post for more. [https://download.zeek.org/zeek-4.0.6.tar.gz](https://download.zeek.org/zeek-4.0.6.tar.gz) [https://download.zeek.org/zeek-4.2.1.tar.gz](https://download.zeek.org/zeek-4.2.1.tar.gz) On April 12, Benjamin Bannier published a bug fix for Spicy, version 1.4.1. The code is posted here: > **[Release v1.4.1 · zeek/spicy](https://github.com/zeek/spicy/releases/tag/v1.4.1)** > > Bug fixes > > GH-1161: Fix incorrect exception for parse errors. (Benjamin Bannier, Corelight) Details on the changes are posted here: > Zeek Blog and Mailing List The mailing list featured several interesting threads. The longest involved how to uninstall Zeek: [https://lists.zeek.org/archives/list/zeek@lists.zeek.org/thread/QTTPW5QYCNO7MAJGPE6GZAVZAZMWTQNM/](https://lists.zeek.org/archives/list/zeek@lists.zeek.org/thread/QTTPW5QYCNO7MAJGPE6GZAVZAZMWTQNM/) The blog featured two stories. The first appears in the Upcoming Events section. The second involved Johanna Amann’s notice that ZeekWeek 2022 will be held the week of October 11-14, in Austin, Texas, USA. The project will open a call for presentations soon. For more, see the blog and mailing list archive: > **[Zeek: Blog](https://zeek.org/blog/)** > > Visit the post for more. [https://lists.zeek.org/archives/list/zeek@lists.zeek.org/](https://lists.zeek.org/archives/list/zeek@lists.zeek.org/) Zeek in the Community Richard Bejtlich published two Zeek in Action videos, on March 24 and April 8: Comparing Zeek Connection Logs with NetFlow Records [![](https://i.ytimg.com/vi/RHAL9tr2gi4/hqdefault.jpg "Zeek in Action, Video 14, Comparing Zeek Connection Logs with NetFlow Records") ](https://www.youtube.com/watch?v=RHAL9tr2gi4) Revisiting NetFlow and Zeek Data [![](https://img.youtube.com/vi/BrGHfWkbYlg/maxresdefault.jpg "Zeek in Action, Video 15, Revisiting NetFlow and Zeek Data") ](https://www.youtube.com/watch?v=BrGHfWkbYlg) On April 6, Fatema Bannat Wala hosted a Zeek community call. The recording is here: [![](https://img.youtube.com/vi/sFjovzmmrls/maxresdefault.jpg "Zeek Community Call, 6 April 2022") ](https://www.youtube.com/watch?v=sFjovzmmrls) Keith Jones’ presentation on importing Zeek logs into Elastic is now available: [![](https://img.youtube.com/vi/n1x4ShzhAo8/maxresdefault.jpg "ElasticCC: zeek2es.py - An Application to Make Your Zeek Logs Elastic") ](https://www.youtube.com/watch?v=n1x4ShzhAo8) Johanna Amann’s keynote to the 2022 Passive and Active Measurement Conference, titled "Expect the Unexpected: Lessons from a Decade of Passive Network Measurements" is now available: [![](https://img.youtube.com/vi/CH9Z66EmMdI/maxresdefault.jpg "PAM2022 - Opening + Keynote 1: Dr. Johanna Amann") ](https://www.youtube.com/watch?v=CH9Z66EmMdI&t=1706) Zeek Package Updates The following packages recently reported updates as of April 22, via this search: [https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed](https://github.com/zeek/packages/pulls?q=is%3Apr+is%3Aclosed) Update EternalSafety package index file #180 by 0xl3x1 was merged 3 days ago Remove ReservoirLabs packages since their repos have vanished #179 by ckreibich was merged 25 days ago The packages.zeek.org site reported the last 5 updates as of April 22:     4/21/22, 8:34 PM zeek-kafka     4/21/22, 2:50 PM spicy-plugin     4/19/22, 5:18 AM zeek-EternalSafety     4/18/22, 2:27 PM zeek-spicy-openvpn     4/15/22, 5:29 PM zeek-httpattacks Zeek in the Enterprise On April 21 Corelight published a blog post on Detection Windows NFS [Network File System] Portmap Vulnerabilities. > **[Detecting CVE-2022-24491/24497 Using Corelight & Zeek | Corelight](https://corelight.com/blog/detecting-windows-nfs-portmap-vulnerabilities)** > > This blog post discusses Zeek detection packages for CVE-2022-24491 and CVE-2022-24497 developed by Corelight Labs. Corelight developed and published two Zeek packages to detect attempts to exploit these vulnerabilities: > **[GitHub - corelight/CVE-2022-24491: A Zeek CVE-2022-24491 detector.](https://github.com/corelight/CVE-2022-24491)** > > A Zeek CVE-2022-24491 detector. > **[GitHub - corelight/CVE-2022-24497: A Zeek detector for CVE-2022-24497.](https://github.com/corelight/CVE-2022-24497)** > > A Zeek detector for CVE-2022-24497. See the blog post as well for links to packet captures used to test and develop these Zeek packages. Crowdstrike’s Humio Community Edition now features demo data from a Corelight sensor, powered by Zeek. See Ken Greene’s blog post for details: > **[Faster Detection, Search, and Resolution | CrowdStrike Falcon® LogScaleTM](https://www.crowdstrike.com/en-us/platform/next-gen-siem/falcon-logscale/)** > > Uncover security and reliability issues before they impact your business with CrowdStrike Falcon® LogScale™. Humio Community Edition is a no-cost, cloud-based offering that accepts up to 16 GB of data ingested per day, with a 7-day retention period. [https://www.humio.com/getting-started/community-edition/](https://www.humio.com/getting-started/community-edition/) Upcoming Events The project is delighted to announce that members of the training team will offer free online training on May 20. The event will consist of two sessions, beginning at 8 am US Pacific Time 3 pm UTC. 8:00 am - 12:00 pm Pacific Time Beginner training is aimed at users who have little to no experience with Zeek. Keith Lehigh and Fatema Bannat Wala will introduce basic architecture, show how to run and customize Zeek on the command line, and give guidance on basic log analysis. 1:00pm - 4:30pm Pacific Time In this hands-on session, Aashish Sharma will walk attendees through the fundamentals of Zeek scripting and will offer some practical exercises. The training is free but registration is required, on a first-come, first-served basis. If you want to attend both sessions, you must register for both sessions: > **[Zeek Training](https://www.eventbrite.com/e/zeek-training-tickets-319863188407)** > > Due to high demand for the Zeek training, this year we will be providing Zeek Project training twice a year. See [Zeek: Events](https://zeek.org/events/) for other events. Zeek Related Jobs The following are a sampling of job opportunities that mention Zeek skills. Sr. Zeek/Bro Engineer Latitude Inc Tysons Corner, VA [https://www.linkedin.com/jobs/view/sr-zeek-bro-engineer-at-latitude-inc-2987609780](https://www.linkedin.com/jobs/view/sr-zeek-bro-engineer-at-latitude-inc-2987609780) Lead Engineer - Network Security Target Brooklyn Park, MN > **[1,000+ Principal Security Engineer jobs in United States](https://www.linkedin.com/jobs/principal-security-engineer-jobs?trk=expired_jd_redirect)** > > Today's top 1,000+ Principal Security Engineer jobs in United States. Leverage your professional network, and get hired. New Principal Security Engineer jobs added daily. Senior Consultant, Incident Response Remote CrowdStrike Sunnyvale, CA > **[67,000+ Senior Consultant jobs in United States](https://www.linkedin.com/jobs/senior-consultant-jobs?trk=expired_jd_redirect)** > > Today's top 67,000+ Senior Consultant jobs in United States. Leverage your professional network, and get hired. New Senior Consultant jobs added daily. For more, see [115 Zeek jobs in United States](https://www.linkedin.com/jobs/search/?geoId=103644278&keywords=zeek) Get Involved If you have any comments or material for the newsletter please email news@zeek.org or join the #news Slack channel. > **[Slack | AI Work Platform & Productivity Tools](https://zeekorg.slack.com)** > > Boost productivity and save time with Slack‌ — ‌the AI work platform for managing projects, automating workflows, and connecting teams securely. Start working smarter today. The Slack channel has been very active during the past month. Join today! Here is an invitation link: > **[Slack](https://zeekorg.slack.com/join/shared_invite/zt-12z1pjy93-zuVGuT1BF~yUJJvERxhp7g)** Stay up to date by subscribing to the Zeek mailing list: [http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek](http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek) Follow us on Twitter: [https://twitter.com/Zeekurity](https://twitter.com/Zeekurity) Subscribe to our video channel: > **[Zeek](https://www.youtube.com/channel/UC1K5-MWaM1XZcEFPCMrmNMw)** > > This is the home for video content by the Zeek project. We produce open source software for network security monitoring. See you next time! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/zeek-newsletter-issue-17-april-2022/6467/2 "2022-05-06T15:47:52Z")