Incident Response and Threat Intelligence with Zeek

Master the fundamentals of network threat detection and incident response with Zeek's powerful analysis capabilities. You'll start by developing custom detection scripts to identify port scans, SQL injection attempts, and brute force attacks in captured network traffic. From there, you'll implement file extraction and hash-based malware detection to identify malicious executables transferred across the network. The lab culminates in deploying advanced correlation rules that detect multi-stage attacks and command-and-control communications. Throughout the exercises, you'll work with real network captures from a security incident at Globomantics, applying detection techniques essential for SOC analysts and incident responders.