Getting Started with Zeek PCAPs | Chris Brenton

00:00 - Intro/Pre-Show Banter
01:08 - Going through PCAP files with Zeek
05:00 - Datamash
10:00 - Sorting Conn files with Zeek-Cut
13:58 - Using Grep to find Single IP Address
17:30 - DashD in Zeek
21:53 - Q&A

Description: After demonstrating T-Shark, Chris Brenton returns to show us how to go through PCAP files with Zeek!

Commands from video:

beacon-data 67.205.130.225 167.172.154.151

Contents of the beacon-data script:

Antisyphon Socials

Antisyphon Training

Antisyphon Shirts

Educational Infosec Content

Backdoors & Breaches - Incident Response Card Game

#infosec #antisyphon #bhis