start	end	text
14720	20360	Outstanding. Apologies for that. So, my name is Aaron Seto. I am the Director of Learning at CoreLite.
20360	25760	And today I'm going to be talking a little bit about the Zeek open source project in the light of OpenSoC.
25760	28720	So, I've actually been part of the OpenSoC team for several years.
28720	32540	Very excited to kind of talk about how these two projects are going to work together.
33220	38400	Today's presentation was actually going to be a joint presentation with Amber, who is our Zeek Community Director.
38400	43140	She had some unforeseen circumstances came up, so I'll be talking a little bit about the community piece,
43140	47460	but I'll try and do it justice to her content.
47640	55320	To kind of talk a little bit about... hold on, let me get my... I see that is going to be...
55320	59880	I do not blame Discord right now. It just had the rug pulled out from under it.
59880	61340	So, let me switch over to this.
61740	64460	So, I'm going to talk a little bit about Zeek. What is Zeek?
64460	77440	It's an open source framework that is used for network security monitoring, basically looking at network traffic.
77440	80300	And you might have heard of Zeek as BRO.
80300	86040	So, this was back in 1995. BRO started at Lawrence Berkeley National Labs.
86040	89980	And there were a number of people who were looking into this problem space,
89980	96280	and were thinking not even in a security context, but just looking at network traffic at large.
96520	106260	And the name BRO really was kind of a nod to Big Brother, being like, this has a lot of surveillance potential,
106260	111080	but it also has a lot of network security potential, which is obviously what we'll be focusing on today.
111080	119960	But if you've heard of BRO or if you've heard of Zeek, it was probably as part of a research center university government,
120800	124200	even potentially for like network forensics and network operations.
124200	128880	There's actually some vendors, though I mentioned I'm employed by Corlite.
128880	134640	There are a number of vendors who actually have Zeek integrated in with their platform and use it.
134660	138200	So, if you've heard of it before, that's probably why.
138600	142120	Zeek itself is actually very customizable, very extensible.
142120	144380	It's really kind of its own language.
144380	151260	And there's a lot that you can do with Zeek in terms of just having scripts and plugins and protocol analyzers
151260	156160	and kind of these components that work together to analyze your network traffic.
156200	158840	So, there's the Zeek package manager.
158840	163340	If you go to packages.zeek.org, you can see all of these packages that the community has contributed.
163340	166480	But you also, because it's open source, you can write your own.
166480	170180	And so, there's actually a try.zeek.org environment where you can play around with that.
170180	172200	And I'm not going to dive into that too much right now.
172200	173940	I just want you to know that it's out there.
175440	177940	So, what is the data?
177940	180120	Like, the Zeek data is really where the power is.
180120	182240	And I want to talk about what that looks like.
182240	187500	So, I'm going to use three examples here, three logs to kind of start that conversation.
187500	189280	On the left is the con log.
189280	191820	So, that's the connection log.
191820	195380	If you've ever seen NetFlow and it's got like IP addresses, ports, protocols, timestamps,
195380	199820	like all this really high-level information, that's basically the con log.
199820	202200	Every single connection will appear in the con log.
202200	205340	But then there's these other logs that are more protocol-specific.
205340	207240	So, let's say I have HTTP data.
207240	210440	Like, I have a web browser talking to a web server.
210600	213980	I'm going to see all of the metadata associated with that connection.
213980	217040	So, things like what was the user agent string that was sent?
217040	219880	What's the URI that was requested if you're talking about the client side?
219880	222720	From the server side, like what was the MIME type that was returned?
222720	224880	How many bytes? What was the status code?
224880	227640	All of those things we see in our HTTP log.
227660	231080	Similarly, if we're talking about other protocols, let's say like DNS,
231080	234760	I can see the DNS, like the client and the server.
234760	237860	I can also see the queries and the answers, the responses,
237860	240920	which is surprisingly difficult to dig into sometimes.
240920	242620	We'll talk about that more in a second.
243000	247900	Now, realistically, there are only a few logs that you're really focused on
247900	253800	in a given environment, in a given exercise, and frankly, even in OpenSoft.
253920	258540	But, there are probably pushing four dozen logs in total now
258540	260520	in the ZEKE OpenSource project.
260520	264020	So, there's a log for pretty much any protocol you can think of,
264020	267560	and all that metadata, that rich metadata from that protocol,
267560	270960	is stored in that log for whatever purpose that you might need.
270960	272980	I've got a couple links down at the bottom, too.
273280	276640	CoreLite has a little PDF cheat sheet. I'll have that link for you in a second, too.
277220	280680	And the ZEKE OpenSource project has really good detailed documentation
281180	283780	about logs and even some things that didn't make the cheat sheet.
283840	286940	That's actually where I stole these graphics from, was from the CoreLite cheat sheet,
286940	288700	because it's a little more colorful.
289900	294220	So, to really talk about how we use ZEKE,
294220	296660	let me start off by kind of comparing a little bit.
296660	299080	So, we need to see if things are actually fine, or if maybe things are fine,
299080	300980	or if things are actually not true,
300980	303660	then we get something from tools like Wireshark and gpdump.
303740	307480	Or, in the middle, we have intrusion detection systems,
307480	309000	intrusion prevention systems.
309000	311420	So, things like Snort and Suricata,
311420	313960	things that we'll find as we kind of work our way through
314460	321540	just kind of looking at this kind of signature-based detection.
321700	323700	And then, on the far right, we have NetFlow.
323700	328560	We have the IP addresses, ports, protocols, timestamps,
328560	329900	that kind of high-level information.
329900	331420	These are three very common tools,
331420	336120	which we'll see as you're kind of getting familiar,
336120	338020	as you're probably already familiar with.
338020	341320	But, let's use those to kind of compare ZEKE.
341320	346580	To start off with, ZEKE is really fundamentally different from something like NetFlow.
346580	349680	Well, it's fundamentally different from all of these, but let's start with NetFlow.
349880	353900	So, NetFlow is giving us just that IP address, port, protocol, timestamp,
353900	355720	just that generic info,
355720	363800	versus something like ZEKE is going to be able to understand protocols at a much deeper level.
363800	368000	So, it understands how something like HTTP works,
368000	369820	and it can pull out all that metadata.
369820	374420	It can even see things like files being sent over HTTP and extract those files out.
374420	378000	So, we're not saving everything, we're saving the most useful tidbits.
378540	380320	And really, when you're thinking of ZEKE,
380320	383120	I don't want to talk about how it compares to some of these tools.
383120	386240	I want to say, like, throw away your IDS, throw away NetFlow.
386240	387520	What should be useful?
387840	390540	Deploy ZEKE in parallel with these tools.
390540	393740	And especially if you have something like full packet capture,
393740	397200	then you can go ahead and use ZEKE to help find
397200	402560	where the most interesting pieces of that full packet capture, that data resides.
403460	407460	Now, comparing ZEKE to an IDS is something that's very commonly done.
407460	409300	And I want to take just a second to talk to that,
409300	413140	because ZEKE isn't here to say what's good or bad, or what's right or wrong.
413140	415920	It's here to say, this is what's happening in the network right now.
419180	424880	So if something goes south, it's because I need to respond to that,
424880	427720	or at least I need to investigate it to look at it.
427740	430860	But ZEKE is here logging everything that's going on
430860	434580	and giving us the control to say, is this good or is this bad?
435280	438800	Now, as I mentioned before, ZEKE is very expandable, very extensible.
438820	441740	And so there's a lot of things that we can add on to ZEKE.
441740	445540	We can kind of do things like, hey, if you see these kinds of anomalies, let me know.
445540	448800	Because ZEKE understands protocols at such a low level,
448800	452700	it can do things like say, hey, this looks like protocol abuse.
452700	457880	This looks like a situation because I totally understand how this protocol should work.
457880	461200	And this is not conforming to that standard.
461220	464100	I'm going to go ahead and write a notice log.
464100	465940	I'm going to go ahead and write something to the weird log.
465940	468200	And we'll talk about some of those logs a little bit more in a second.
468200	470560	But there's a lot of things that we can do with this.
470920	472920	So when I'm talking about ZEKE data,
472920	477780	what I'm really talking about is the representation of network traffic,
477780	483540	of what you're seeing on your network as it's represented in ZEKE data.
483540	486040	Now, there's a couple ways you can get those logs out.
486040	488000	You can look at the raw ZEKE logs.
488000	490620	And we'll kind of see a little bit of that today.
490700	495680	But as you normally use in an enterprise, and as you'll use in OpenSOC,
495680	500600	that data is being forwarded to a SIEM where you can interact with that
500600	504680	and get the context of all the other host-based data
504680	507820	and everything else that's coming into that SIEM environment.
507940	513340	So in case you haven't guessed already, our SIEM of choice for OpenSOC,
513340	516000	if you were watching the workshop earlier, is Greylog.
516000	518620	And so we'll talk about what this looks like in Greylog.
518880	522720	But one of the things that is... before we jump into that,
522720	527700	I want to talk about how we kind of associate these logs with each other.
527700	531020	So remember I said we have a CON log and an HTTP log.
531300	535060	And so every connection that comes in, I'll see in my CON log,
535060	538800	but every time there's some HTTP data,
538800	544260	HTTP application layer protocol identified in this connection,
544260	549580	there will be an HTTP log for that connection that has all that relevant metadata.
549580	552400	Now, the question becomes, how do I kind of pivot?
552400	556180	I see something in my CON log, and I know there's HTTP in there.
556180	559540	How do I go find the matching thing in my HTTP log?
559920	563140	So the way you're going to do that is with what's called the UID,
563140	564760	or the connection unique ID.
564760	567800	And that's something that every time there's a mention of this connection,
567800	570640	it's going to appear in any one of these logs.
570640	574780	So if I have a connection, let's say, that uses HTTP,
574780	576880	and let's say it transfers a file.
576880	580780	Well, then I'm going to see that same UID in my CON log, in my HTTP log,
580780	586360	in my files log, and each one of those logs is going to give me the information about that file transfer.
586360	591160	On the topic of file transfers, there's another type of unique ID called the file unique ID.
591160	596320	And similarly, if I kind of want to pivot around and investigate a file that's happening,
596320	601440	or that I'm interested in, then I can use that file unique ID and search through logs
601440	605880	and see what connections are associated with that unique ID.
606660	610860	So, all right, I've done a lot of the explanation.
610860	614260	I want to dive into one pretty thorough use case.
614260	615500	And I want to do this for two reasons.
615500	619820	One, I want to get you in the mindset of how an incident responder thinks.
619820	621720	And for some of us, that's not a stretch.
621720	623480	And for some of us, that might be a little new.
623560	628240	But the second thing I want to do is I want to show you how you would use just a ZEKE data
628240	630860	to work through a particular incident.
630860	637560	And so let's say I'm fresh out of college or fresh out of another career field I'm pivoting.
637560	640680	And I just joined this team.
640680	643680	I'm a SOC analyst. I'm entry level.
643720	649880	And as is tradition, I am awarded the honor of the night shift.
649880	652740	And I'm sitting here, and I'm watching alerts roll in.
652740	655500	And it's my job to kind of triage these alerts.
655500	661660	So I'm trying to figure out when something comes in, do I have like a playbook or procedure,
661660	666620	something that I can fall back to, to say I know how to handle this, we've seen this before,
666620	671340	or I have something in my playbook that I know how to resolve this myself.
671580	675340	Is it maybe instead something that I can dismiss?
675340	678580	I can say, well, this is a false positive, or this is not actionable.
678680	682700	Okay, somebody's port scanning. Doesn't matter. I can't really do anything about it.
682700	687300	Or in the third case, do I need to escalate this?
687300	690960	Do I need to bring this to someone, a senior member of our team,
690960	697680	who can then spend a little bit more time looking at this, or maybe has the expertise to work through this?
698060	702000	And so it's 2 a.m. I'm sitting here. I'm watching these alerts roll in.
702000	705820	I'm trying to figure out, can I deal with this? Can I deal with this myself?
705820	708460	Can I dismiss this? Do I need to escalate this?
708460	712060	And an alert comes in from our Intrusion Detection System.
712060	715460	And it says, hey, I saw a DNS request leaving the network,
715460	718980	and the host name in that DNS request matched the signature.
718980	722140	So the IDS raised an alert to say, I know that.
722140	727000	I have a signature that says that's associated with a known command and control server, a C2 server.
727000	730060	So what am I going to do? Can I deal with this myself?
730060	732420	Can I dismiss this? Do I need to escalate this?
732420	737640	And if I just have this data to look at this, I might start off in my DNS log.
737640	742220	So I mentioned there's a log for DNS, and this is a DNS-related alert.
742220	747700	Let me turn to my DNS log, and I'm going to see the workstation or stations, potentially,
747700	750520	that have tried to reach out and look up that host name.
750520	754280	The DNS servers that responded to that, which maybe is something internal.
754280	759980	Maybe it's an external DNS server, depending on how I can block that from leaving my network.
759980	765800	I see the query itself, which in theory my IDS already told me, so it's not really that big of a deal.
765800	770080	But the big one here is the answer field. It's literally called answer.
770080	774520	There's a field in your DNS log, and it is the response that was provided to the client.
774520	780880	So in this case, I know the client queried for this host name. I want to know what IP address they got back.
780880	787020	A lot of times, even with good DNS logging setup, if you have your DNS server set up to forward logs,
787160	791260	a lot of times they won't give you that last piece. They won't give you the answer, the IP address.
791260	796100	And I need that, because I need to pivot from my DNS log to my con log.
796100	802700	The question that I'm asking myself right now is, okay, I know that there was a DNS request leaving the network,
802700	808500	but was there a connection that followed that to the IP address that was resolved?
808620	814080	Maybe I had an intrusion prevention system that stopped it.
814080	820120	Maybe I got lucky and the attacker's infrastructure was down, and I just dodged that bullet.
820120	823240	But I want to know if there was a connection. I want to know more about it.
823240	826680	And let's say for the sake of this example, there was. There was a connection.
827260	832840	And so I can pivot from my DNS log to my con log, look for connections to that IP address,
832840	836280	say that there were connections. I want to see what ports they're on.
836280	840620	When did they happen? Are they still happening? How many bytes were sent either way?
840940	845600	And ports in particular is interesting, because I want to know a little bit more about this communication.
845600	851860	Let's say for the sake of this example that the communication to that server was on port 80.
852040	855900	Well, the more veterans of you might say, port 80 is obviously HTTP. I know that.
856020	859960	But hang on, put your attacker hat on for a second and think about this.
860020	864560	An attacker doesn't have to use the port for its intended purpose.
864560	868120	So just because they're on port 80 doesn't mean they're using HTTP.
868320	874120	But one of the cool things Zeke does is it has what's called dynamic protocol detection, DPD.
874120	881380	So I'll see in my con log a field called service that tells me the protocols identified.
881380	885700	Zeke knows, regardless of what port it's on, what's going on inside that connection.
885700	889860	And so it'll say, yep, I know there's HTTP inside of here. I don't care that it's on port 80.
889860	894100	I mean, obviously, that wouldn't be what we would expect.
894260	897980	But Zeke tells me certainly this has HTTP traffic.
897980	903020	So I'm going to pivot now from my con log to my HTTP log to get more information.
903020	906040	And how do I pivot between those two logs?
906480	909620	The connection unique identifier, that UID field.
909620	914520	Remember, that appears in every single log that has information about this connection.
914520	921880	So I'm going to look to that UID field and look to see if I have a matching entry in my HTTP log.
921880	925980	And in there, I'm going to see things that relate to this connection.
925980	929160	Things like user agent strings and cookie values, get push parameters.
929160	933220	Things that the browser sends as part of that request.
933220	934980	And also I get some response information.
934980	942120	And these are things that you'll hear the term indicator, or an IOC, or an indicator of compromise.
942120	946920	These are things that might help us figure out exactly what this is, what malware strain we're dealing with.
946920	953440	And that's something that, again, I might be able to go back to previous incidents and playbooks and community resources and say,
953440	957720	Hey, what is this thing? Does anybody recognize this string that looks a little bit weird?
957720	960720	Do I know what malware that's associated with?
961840	965060	And so, if so, I might be able to handle this myself.
965060	969900	I might say, all right, cool. This is an incident that I know how to resolve.
969900	973020	I'm going to go ahead and quarantine, you know, kick that machine off the network.
973260	979460	I'll contact the user. We'll start an IT ticket, get it re-imaged, and probably reset the user's password.
980040	982120	But, okay, I can handle it, right?
982860	985620	But, I like being the worst-case scenario person.
985620	988920	What happens if I don't know how to deal with this?
988920	995360	What happens if I don't have any indicators that I can pull up and say I know what malware strain this is?
995380	999220	Let's say, for the sake of this example, that this is a downloader.
999220	1004480	This is a piece of malware that kind of establishes a foothold on this compromised workstation
1004480	1008580	and then beacons out to a C2 server and starts downloading additional malware.
1008580	1019420	It's going to bring back tools, things that might potentially let the attacker find a foothold on this workstation or within this network.
1019420	1026020	So, in that case, I would see all these HTTP connections and I would see mentions in my files log
1026020	1031060	so I could pivot from the HTTP log to the files log using that connection ID again
1031060	1033820	and say, hey, what files are being transferred here?
1033820	1040500	Specifically, I'm looking for... so Zeke has the ability to extract MD5, SHA-1, and SHA-256 checksum.
1040580	1044420	And so these checksums are things that, again, can be an indicator of compromise.
1044420	1047080	Another IOC that I can use and go back and say, what is this?
1047460	1050680	Maybe I don't know what the downloader is, but I can kind of know what these other tools are
1050680	1053280	and I can start to understand what the capabilities of this are.
1053280	1057840	I can also look around my network and see what other machines have seen those hashes
1057840	1063320	and maybe there's other machines that are part of this compromise that I'm just now discovering now.
1065660	1069560	But let's say... I don't know, I like being the worst case scenario person.
1069560	1074720	Let's say that the attacker gets a foothold on that machine and starts deleting evidence,
1074720	1079400	which, you know, putting my open-sock hat on for a second, it's been known to happen.
1079400	1082640	So let's say the attacker goes in and starts to clean up after themselves.
1082640	1088280	And I'm like, well, great, all the information on that endpoint now that the evidence is getting erased.
1088280	1091780	Well, remember I talked about Zeke having file extraction.
1091780	1095780	So I can pull out those files as they go across the wire, save them to disk,
1095780	1101220	and even if they get deleted, you know, zero-wise, wiped, whatever, off that workstation,
1101220	1103180	I still have those binaries.
1103180	1108460	So putting my worst case scenario hat on again, if I say, all right, well, the evidence has gone over there,
1108460	1112680	I still have these binaries that I can go back to and figure out exactly what they're capable of.
1112680	1116660	If I have to escalate this and, you know, it's 2.15 in the morning now,
1116660	1121580	and I have to call one of the senior members of my team to say, yo, this looks bad.
1121780	1124020	You know, I'm pretty sure this is an actual incident.
1124340	1126200	Here are the things that I know so far.
1126200	1127800	I know the IP address that we're getting out to.
1127800	1131700	I can tell you all the hosts that are talking to that host name or that IP address.
1131800	1136940	I have some indicators that we can potentially write some IDS signatures for so we can catch this in the future.
1137020	1141720	I have these SHA-1, MB5, and SHA-26 hashes that we can, you know, search the network,
1141720	1145400	and I can tell you what machines have this malware associated with them.
1145400	1150720	So I figured out the scope, and I mean both in time and in the hosts associated with this.
1151000	1158100	And if we have to bring in, you know, reverse engineers or, you know, malware analysis people,
1158100	1160640	they have those binaries they can start tearing through.
1160640	1164800	So even in the worst case scenario, I've got a lot of evidence here,
1164800	1167960	even without talking about anything on the endpoint at all.
1168180	1171220	So I know I belabor this quite a bit,
1171220	1175640	but I think it's powerful to talk through kind of the questions that you'll be asking yourself
1175640	1179780	as you're going through something like an open-socket exercise or a real-world exercise.
1179780	1181100	They're shockingly similar.
1181920	1187960	And also to understand where you go in the ZEKE data to understand those questions a little bit better.
1188000	1192000	So there's many ways, as I mentioned, that this ZEKE data can be represented.
1192000	1197540	So here I have a screenshot of Splunk, which is, you know, you can get a free version and pipe the data into Splunk.
1197540	1201200	And so, sure, that's a thing, you know, if you're a Splunk person.
1201200	1203500	We had a talk earlier on Kibana.
1203500	1207420	Instead of asking if you're using the Elastic, the Elk stack,
1207420	1212160	you can feed this data into Kibana and look at it that way as well.
1212400	1216200	But our tool of choice in open-socket is going to be Greylock.
1216320	1220560	And so you should get comfortable with what this looks like in Greylock.
1220560	1225600	So to start off with, when you get access to the open-socket environment and you go to Greylock,
1225600	1228400	you might end up looking at a screen like this.
1228400	1232100	When you click on the screens, you're just going to get the stream of data.
1232100	1235840	This is everything that's going across the network right now. It's a ton of data, right?
1236260	1241500	And so as you're looking through this, I want to talk to you a little bit about the Greylock interface,
1241500	1245520	but also we'll use it to kind of talk about what the ZEKE data will look like.
1245520	1253140	So to start off with, you'll notice that I've typed a query into my Greylock window here that I am looking for ZEKE data.
1253140	1259140	Specifically, I am asking Greylock to search for a field called event type,
1259140	1262160	and I want you to tell me when that event type equals ZEKE.
1262160	1270380	And so this is going to limit down the events that are returned back to me as part of this UI.
1270580	1275980	And so this is a gotcha that you'll find again and again, especially in open-socket,
1275980	1279580	where you'll be looking for an artifact and you're like, I can't find it, it's not here, I don't know where it is.
1279580	1283140	It's because you probably have your search set to the last five minutes,
1283140	1288280	and if you're looking for something that happened several hours ago, well, yeah, you're not going to see it.
1288280	1294980	So I'm also going to go ahead and turn down, or turn up, I guess you could say, my search window to a larger window.
1294980	1301440	Maybe I have a particular time span and I can input that, but right now I'm just kind of taking a casual stroll through the data.
1301540	1308000	So with those things, I'm going to scroll down a little bit, and on the right-hand side here, you see the Greylock events.
1308000	1317300	And so these are Zeek events, specifically, and you'll notice there's a lot of them, but each one of these is a Zeek log,
1317560	1321420	a line in a Zeek log that's giving me some information about communication that happened.
1321420	1325760	And if I click on any given one of them, you'll notice the event type is Zeek, that's why this was returned.
1325760	1330080	And there's a lot of information here inside this particular log entry.
1330080	1336500	The first thing that you should look at, the first thing I want you to get familiar with, is this file field.
1336500	1339620	And the file field tells me which type of log is this.
1339620	1343700	In this particular case, I'm looking at a MySQL log or a MySQL log.
1343700	1347780	So this is going to have information about a database transaction that occurred here.
1347780	1351720	Now, if you look down a little bit further, you will see the message, which is the line.
1351860	1355520	These are the individual fields of the MySQL log.
1355520	1363860	Now, there's one thing I'm going to come completely clean here, and some of the logs that you'll see, they're really parsed that cleanly.
1363860	1370100	So for something like this, I have to kind of turn back to some of those cheat feeds for that documentation to figure out, like, what does each field mean?
1370100	1377460	Like, I can see the first field is a timestamp, and the second field that starts with a C, that's my connection unique ID, so that's something I can pivot off of.
1377460	1380440	I see some IP addresses, some ports, I see a MySQL query.
1380440	1385260	Sometimes it's a little self-explanatory, but refer to that documentation as needed.
1385260	1386880	Let me give you another example here.
1386880	1388820	So I'm scrolling down, looking at another entry.
1388820	1391980	Again, event type is Zeke, that'll be consistent.
1391980	1396280	But instead now, I'm looking at the con log, so this is that connection log.
1396280	1399580	This is giving me information about a connection that occurred.
1399860	1405440	And I see the message down here that those fields, which you'll also notice, all the fields have been broken out for me.
1405440	1408280	So I can see the connection state, the destination IP.
1408320	1411120	There's a Boolean that tells me, is that inside my network?
1411140	1413400	And that's a Zeke variable that gets set.
1413400	1415560	I get to see, you know, the destination port.
1415560	1418200	The history field is actually a really interesting one.
1418200	1421640	I don't have nearly enough time to dive into it, but it's really well documented.
1421640	1426560	And it tells you kind of the order of things that happened inside the communication.
1426680	1428000	So there's a lot of things here.
1428000	1433740	And also, you'll notice, I could scroll down, but I can also see it here in the message field, that connection unique ID.
1433900	1435980	So, sure, there's a connection here.
1435980	1437860	All right, it's on port 80.
1437860	1439180	Is it HTTP?
1439180	1441180	Well, I see HTTP in my message there.
1441180	1444260	And if I were to scroll down, I would see that as part of my service field.
1444260	1453380	But I can look and search, write a great log query to search for that connection unique ID, and find all the information associated with this particular connection.
1453700	1455760	So as we scroll down a little bit further...
1455760	1458300	Oh, look, here's an HTTP log entry.
1458360	1461940	And so this file here tells me I'm looking at the HTTP log.
1461940	1464240	I get a little information from the client side.
1464240	1468700	So it looks like this was a GET request for the slash link on the root page.
1468720	1470940	So I can see a little bit of information from the client.
1470940	1473140	I can see a little bit of information from the server.
1473140	1476840	I respond back with a 200 OK, which is perfectly normal.
1476840	1477280	Right.
1477660	1480380	At least that's what I would generally expect.
1480380	1483900	And so all these fields, again, are broken out for me as I work my way through.
1483900	1487680	One more log entry I want to talk about is the files log.
1487680	1492200	So I mentioned that whenever we see a file transfer, the example I used was HTTP.
1492200	1497640	But it actually works over SMB, SMTP, HTTP, FTP.
1498300	1500380	I'm sure I'm forgetting many of them.
1500380	1505180	But fundamentally, if we can see a file transfer that's happening, we can pull that off the wire.
1505320	1510560	And so you'll see an entry in your files log that gives you things like the LIME type.
1510560	1513520	So, oh, this looks like it was an MP4 video.
1513540	1517600	I get those hashes, those checksum values, which in the case of a video...
1517600	1519160	Maybe that's interesting or not.
1519300	1521840	Or a document, that might be a lot more interesting.
1521840	1525580	That might be something that would be a very interesting indicator to key off of.
1525980	1528300	In some cases, you'll see the file name.
1528300	1532460	In this particular case, this was part of an HTTP connection that just wasn't provided in a header.
1532460	1534920	We just couldn't extract it for one reason or another.
1535060	1539060	But if we do get the opportunity to pull a file name off the wire, we'll happily do that.
1539300	1541760	There's one thing that I didn't have an arrow to on the slide.
1541760	1545360	And that, as you'll notice just under the file name, is the file unique ID.
1545360	1550820	And so similar to the connection unique ID that starts with a C, the file unique ID starts with an F.
1550820	1554380	And that tells me that this is associated with a file transfer.
1555080	1556700	So there's a lot of data.
1556700	1563040	I'm just giving you the highlights, and I promise you're going to see some of those in some OpenSock scenarios later.
1563040	1565820	Not that, you know, I don't want to spoil too much.
1566160	1569480	I'll put these URLs in the Discord chat as well.
1569480	1572640	I'll also post a PDF of these slides, so you'll have these.
1572720	1576880	But these are the two resources I would suggest to get comfortable with Zik data.
1576880	1579960	So the thing on the left is the PDF. I like it because it's searchable.
1579960	1586280	The thing on the right is the Zik documentation from Read the Docs that does a much better job of going into more depth
1586280	1589560	and has more logs that didn't really make the cut on the cheat sheet.
1589980	1595600	So I only have a few minutes left, and I want to talk very briefly about the Zik community.
1595720	1602260	And by all rights, this would be Amber here talking about, as a community director, she would talk authoritatively about this.
1602260	1607120	And there's so much that's going on now and on the roadmap.
1607120	1612100	Fundamentally, the things that you should know about is head to Zik.org slash connect.
1612100	1614700	So Zik.org is the Zik website. They've got a YouTube channel.
1614700	1620040	They've got a Twitter account that's constantly posting and retweeting new packages
1620040	1627160	and things that are relevant to current vulnerabilities that are blowing up Twitter.
1627360	1633660	Zik started a Slack organization, a Slack channel, which Discord... I'm working on it.
1634240	1641440	Slack is the home of a lot of these really great conversations that you can have alongside the Zik developers,
1641440	1644820	the package developers, and they're a really approachable community.
1644820	1653020	That said, because it has such a long history to it, there are also some very good mailing lists that you should join as well.
1653200	1657860	On the bottom left, you see there are a lot of in-person events, obviously not happening at the moment.
1657860	1663860	But keep an eye out if you hear Zik Hour, Zik Days. These are kind of local organizations,
1663860	1668460	so you can kind of come and hang out for a happy hour and meet people.
1668580	1673320	In fact, you can kind of help Amber organize your own if this is something that you want to bring to your area.
1673380	1676980	I'll give you her contact information. She'll be eager to talk to you.
1677100	1683000	Zik Week is actually an annual event that we do, so it's all these conversations about Zik package development.
1683000	1688300	Things from like, how are Blue Teamers using this to defend themselves,
1688300	1695200	all the way down to like the lowest internals of the Zik ecosystem.
1695540	1699380	There are also now a lot of virtual events that are happening.
1699380	1706400	So if you check out the Zik.org site or the Zik Slack, you'll hear about a lot of online events that are happening.
1707560	1713180	There's Zik from Home, there's Ask the Zik-sperts, which is where they bring in a lot of experts,
1713180	1716140	and you can just be like, hey, I'm trying to install Zik at home, and I'm hitting this error,
1716140	1720240	and they'll happily walk you through it. Super, super approachable community.
1720800	1724300	And to that end, I would encourage you to contribute to that community.
1724300	1728620	So a lot of folks, especially approaching open source, think, well, hey, I'm just getting started,
1728620	1732760	or hey, you know, yeah, I'm working on this Blue Team thing, and I'm figuring this out,
1732760	1741060	but I don't know anything about development or, well, anything about what seems like it would be needed here.
1741060	1747620	And I want to dispel that, because there's so many skills that are required to make this work.
1747620	1753240	So yes, you might be thinking in code. You might be saying, well, I'm not a good coder.
1753240	1760640	Well, okay, what about looking into the user community and contributing to, as you're installing this,
1760640	1763740	and you're saying, hey, this documentation, you know, is a little bit unclear.
1763740	1766900	Or, hey, I tried to do this, and this documentation didn't work for me.
1766900	1771580	Let me fire off something on the mailing list and say, hey, I have some suggestions.
1771800	1775680	How do I, you know, make some proposals to the documentation?
1775920	1779040	Maybe you want to try your hand at scripting. Scripting is actually pretty approachable,
1779040	1781920	and there's so much that you can do in the Zika language.
1782080	1786780	Things that are just very simple that are going to help you in your day-to-day,
1786780	1792740	versus like, hey, there's a protocol I just want to tear into, whatever that might be.
1792920	1797940	Maybe you're just saying, hey, you know, I don't know anything about Zika yet.
1798140	1804720	Where could I start? Download it. Get some of the latest releases and give us an okay and say, yep, we tested it out.
1804720	1808240	It worked. Help us test releases and get that feedback.
1808240	1812740	So there's so much that you can do, and it's so tempting to think of this as like,
1812740	1817240	I'm at the bottom of this ladder, and I don't have the skills that I need to climb it.
1817280	1821200	And Amber has this awesome metaphor about, think of this as a lattice.
1821200	1826120	Think about kind of moving diagonally. Think about kind of charting your own path
1826120	1829980	and building your own skill set as you're contributing back to the community.
1829980	1834280	This goes for so many communities, but I think for Zika, it's especially true.
1834620	1841760	So there are a couple links that I threw down earlier, the link to the Zika documentation.
1841760	1845840	So if you're interested in deploying Zika locally, probably something I would recommend putting on
1845840	1848220	until after OpenStock, because you're going to have a busy weekend.
1848460	1851700	But you've got the link there. Again, I'll post these in the Discord.
1851720	1856040	Security Onion, a lot of you know, as kind of the Cali for blue team,
1856040	1860180	it's a Linux distribution that has all of these tools built into them, including Zika.
1860180	1862880	And so if you're interested in just having kind of a live environment,
1862880	1866520	I wouldn't recommend it for like a full production environment,
1866520	1872180	but for just getting your feet wet and understanding how this works together with these other tools,
1872180	1874920	Security Onion is a fantastic starting point.
1874920	1878660	I mentioned that PDF, so I've got the link to the PDF there.
1878660	1881720	And oh, by the way, there's this event that's happening called OpenStock.
1881860	1886420	If you haven't joined the OpenStock Discord yet, there's a lot that's happening there.
1886420	1890840	It starts tomorrow, but you can swing on by, you can get registered and set up.
1890840	1897540	Check out the DC28 OpenStock CTF in the Blue Team Village Discord for more information about that.
1897960	1902180	So with that said, I think I am pretty darn close to time here.
1902180	1905480	I want to leave you with my contact info, Aaron Soto at Corelite.com.
1905480	1910340	Amber is our Zika Community Director, an incredible resource,
1910340	1917760	and just constantly has these amazing plans for the Zika community and helping it grow.
1917760	1923560	So if you are interested at all, there's also a Zikurity Twitter account that I mentioned.
1923640	1926020	There's a Zik channel in that OpenStock Discord.
1926020	1932800	So even if you're not going to play OpenStock, come join the Zik channel and kind of have the conversation there.
1932800	1936340	Keep an eye out for a lot of these online events. As I mentioned, Zik From Home, Ask the Zik Experts.
1936340	1939240	There's a lot more on the way that I'm sure Amber could write a lot.
1939340	1942900	And we're also doing, not quite as cool as OpenStock, I'll admit,
1942900	1947020	but some community CTFs to help you learn the Zik environment.
1947020	1951980	So with that said, I know I am pretty darn close to time.
1952420	1956760	Did we have any questions from the chat?
1956900	1963920	I'm going to scroll and kind of take a quick look here, but if you have any...
1964680	1968160	I'm actually happy to have a conversation with folks afterwards.
1968320	1971200	As I know, we are pretty darn close.
1971320	1974220	I'm hearing people ask about, you know, how hard is it to set up?
1974220	1975460	I'd encourage you if you...