When Detection and Response Controls Fail, One Control Never Does: Network Traffic Monitoring.
Sniffing packets is like eavesdropping on the world's most boring conversation—except sometimes, you catch the network equivalent of juicy office gossip, and suddenly, everyone’s talking about what that rogue device was up to at 3 AM!
Everything fails—even technologies like SIEMs, SOAR, and endpoint protection solutions. I know that's not what you want to hear, but it’s true. Whether due to a sophisticated attack, misconfiguration, or overload, these critical components of modern cybersecurity can fall short. But one control remains resilient: network traffic monitoring.
So what makes network traffic monitoring stand out? It's because it operates independently, based on the principle that all cyber activities, legitimate or malicious, must traverse the network. When you continuously observe and analyze traffic, you'll gain unmatched visibility and insight.
My first exposure to network traffic was with tcpdump in 1987, which laid the groundwork for packet capture and analysis. It quickly expanded with Tripwire in 1992 for file integrity monitoring, followed by Zeek (formerly Bro) in 1995 for deep network traffic analysis. Other key tools like NetFlow, Nmap, Wireshark, Snort, and OpenVAS soon followed, becoming the backbone of modern cybersecurity.
Out of all of these, Zeek stands out for its modernity and robustness. It was developed by Vern Paxson in 1995, Zeek provides deep insights into network traffic and detects sophisticated threats. Its two key features are Network Traffic Analysis and Protocol Parsing.
Zeek captures and analyzes packets as they traverse the network, generating logs invaluable for forensic analysis, incident response, and threat hunting. Its protocol analyzers log various protocols (e.g., HTTP, DNS, SSL/TLS) in detail, aiding security teams in monitoring specific activities.
Zeek/Bro is highly customizable, with extensive logging and scalability. Its scripting language allows custom scripts for detecting specific behaviors, making it adaptable to various environments. Zeek's detailed logs are ideal for post-incident analysis, and it scales effectively in large, complex networks, handling high traffic volumes.
Now, what about Corelight, founded by Zeek/Bro's creators, offering enterprise-grade solutions based on Zeek? Their turnkey appliances are pre-configured, performance-optimized, and easy to deploy, reducing setup time. It's perfect for large enterprises needing streamlined management, automated updates, and enterprise support, Corelight's enhancements provide robust, scalable solutions with advanced SIEM, SOAR, and threat intelligence integrations, enriching security operations with Zeek’s insights.
I had the pleasure of meeting Corelight’s co-founder and Chief Strategy Officer at Black Hat, Gregory Bell. What a pleasure!
#Corelight #Wireshark #tcpdump #Snort #Zeek #PacketSniffer #NetworkMonitoring #NGSIEM