Re:Brim: Open-source desktop app to analyze large pcaps thro...
by LoveKebab on Tuesday April 07, 2020 @04:46PM
(#22807302)
Zeek is actually super powerful.
It’s more of a Network Security Monitoring tool (NSM) than a Wireshark equivalent
It’s primary use case is to have a server(s) ingesting all traffic in a network and forwarding the traffic metadata to something like an Elastic Stack.
What makes it so powerful though, is that it actually has its own scripting language that allows you create automations based off what type of traffic is observed and these can be super intricate
It’s more of a Network Security Monitoring tool (NSM) than a Wireshark equivalent
It’s primary use case is to have a server(s) ingesting all traffic in a network and forwarding the traffic metadata to something like an Elastic Stack.
What makes it so powerful though, is that it actually has its own scripting language that allows you create automations based off what type of traffic is observed and these can be super intricate