[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEFFQXV2Y8ATDBHDY776XR":3,"skill-same:01M6AEFFQXV2Y8ATDBHDY776XR":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":70,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":74,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6AEFFQXV2Y8ATDBHDY776XR","detecting-network-anomalies-with-zeek",null,"Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection\u002FDNS\u002FHTTP\u002FSSL\u002Ffile logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM\u002Fthreat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS\u002FIPS or host agents.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-anomalies-with-zeek\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting network anomalies with zeek","Zeek","network","threat-hunting","network-monitoring","ips","ids","network-security","dns","ssl","security","monitoring","logs","generate","pr","http","threat hunting","siem","incident response","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-network-anomalies-with-zeek\ndescription: Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection\u002FDNS\u002FHTTP\u002FSSL\u002Ffile logs, detect anomalous behavior, and write custom scripts for organization-specific threats. Use for passive monitoring at network choke points, feeding SIEM\u002Fthreat hunting with protocol metadata, or retrospective log analysis during incident response; not a substitute for inline IDS\u002FIPS or host agents.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- zeek\n- network-monitoring\n- anomaly-detection\n- threat-hunting\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n---\n# Detecting Network Anomalies with Zeek\n\n## When to Use\n\n- Deploying passive network security monitoring at key network choke points for continuous visibility\n- Generating structured connection, DNS, HTTP, SSL, and file transfer logs for SIEM ingestion and threat hunting\n- Writing custom Zeek scripts to detect organization-specific threats, policy violations, or beaconing behavior\n- Performing retrospective analysis on network metadata to investigate security incidents\n- Complementing IDS solutions with protocol-level metadata analysis that signature-based tools may miss\n\n**Do not use** as a replacement for inline IDS\u002FIPS that can actively block traffic, for monitoring encrypted payloads without TLS inspection, or on endpoints where host-based agents are more appropriate.\n\n## Prerequisites\n\n- Zeek 6.0+ installed from source or package manager (`zeek --version`)\n- Network interface configured on a span port, network tap, or virtual switch mirror for passive capture\n- Sufficient disk storage for log files (estimate 1-5 GB\u002Fday per 100 Mbps of monitored traffic)\n- Familiarity with Zeek's scripting language for writing custom detections\n- Log aggregation system (Splunk, Elastic, Graylog) for centralized analysis\n\n## Workflow\n\n### Step 1: Install and Configure Zeek\n\n```bash\n# Install Zeek on Ubuntu\u002FDebian\nsudo apt install -y zeek\n\n# Or install from source for latest version\ngit clone --recursive https:\u002F\u002Fgithub.com\u002Fzeek\u002Fzeek\ncd zeek && .\u002Fconfigure --prefix=\u002Fopt\u002Fzeek && make -j$(nproc) && sudo make install\nexport PATH=\u002Fopt\u002Fzeek\u002Fbin:$PATH\n\n# Configure the monitoring interface\nsudo vi \u002Fopt\u002Fzeek\u002Fetc\u002Fnode.cfg\n```\n\n```ini\n# \u002Fopt\u002Fzeek\u002Fetc\u002Fnode.cfg\n[zeek]\ntype=standalone\nhost=localhost\ninterface=eth1\n```\n\n```bash\n# Configure local network definitions\nsudo vi \u002Fopt\u002Fzeek\u002Fetc\u002Fnetworks.cfg\n```\n\n```\n# \u002Fopt\u002Fzeek\u002Fetc\u002Fnetworks.cfg\n10.0.0.0\u002F8       Internal\n172.16.0.0\u002F12    Internal\n192.168.0.0\u002F16   Internal\n```\n\n```bash\n# Disable NIC offloading for accurate packet capture\nsudo ethtool -K eth1 rx off tx off gro off lro off tso off gso off\n\n# Deploy Zeek\nsudo zeekctl deploy\n\n# Verify Zeek is running\nsudo zeekctl status\n```\n\n### Step 2: Understand and Navigate Zeek Logs\n\n```bash\n# Zeek generates structured log files in \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\nls \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\n\n# Key log files:\n# conn.log       - All network connections (TCP, UDP, ICMP)\n# dns.log        - DNS queries and responses\n# http.log       - HTTP requests and responses\n# ssl.log        - SSL\u002FTLS handshake details\n# files.log      - File transfers observed on the network\n# notice.log     - Alerts from Zeek detection scripts\n# weird.log      - Protocol anomalies and errors\n# x509.log       - X.509 certificate details\n# smtp.log       - SMTP email transactions\n# ssh.log        - SSH connection details\n\n# View connection log with zeek-cut for column selection\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes\n\n# View DNS log\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdns.log | zeek-cut ts id.orig_h query qtype_name answers\n\n# View HTTP log\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fhttp.log | zeek-cut ts id.orig_h host uri method status_code user_agent\n```\n\n### Step 3: Write Custom Detection Scripts\n\n```bash\n# Create a custom detection script directory\nsudo mkdir -p \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fcustom-detections\n```\n\nCreate a script for detecting DNS tunneling:\n\n```zeek\n# \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fcustom-detections\u002Fdns-tunneling.zeek\n@load base\u002Fframeworks\u002Fnotice\n\nmodule DNSTunneling;\n\nexport {\n    redef enum Notice::Type += {\n        DNS_Tunneling_Detected,\n        DNS_Long_Query\n    };\n\n    # Threshold: number of unique queries per source in time window\n    const query_threshold: count = 200 &redef;\n    const time_window: interval = 5min &redef;\n    const max_query_length: count = 50 &redef;\n}\n\n# Track query counts per source IP\nglobal dns_query_counts: table[addr] of count &create_expire=5min &default=0;\n\nevent dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)\n{\n    local src = c$id$orig_h;\n\n    # Check for unusually long domain queries (base64-encoded data)\n    if ( |query| > max_query_length )\n    {\n        NOTICE([\n            $note=DNS_Long_Query,\n            $msg=fmt(\"Unusually long DNS query from %s: %s (%d chars)\", src, query, |query|),\n            $src=src,\n            $identifier=cat(src, query)\n        ]);\n    }\n\n    # Track query volume per source\n    dns_query_counts[src] += 1;\n\n    if ( dns_query_counts[src] == query_threshold )\n    {\n        NOTICE([\n            $note=DNS_Tunneling_Detected,\n            $msg=fmt(\"Possible DNS tunneling: %s sent %d queries in %s\", src, query_threshold, time_window),\n            $src=src,\n            $identifier=cat(src)\n        ]);\n    }\n}\n```\n\nCreate a script for detecting beaconing:\n\n```zeek\n# \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fcustom-detections\u002Fbeacon-detection.zeek\n@load base\u002Fframeworks\u002Fnotice\n@load base\u002Fframeworks\u002Fsumstats\n\nmodule BeaconDetection;\n\nexport {\n    redef enum Notice::Type += {\n        Possible_Beaconing\n    };\n\n    const beacon_threshold: count = 50 &redef;\n    const observation_window: interval = 1hr &redef;\n}\n\nevent zeek_init()\n{\n    local r1 = SumStats::Reducer(\n        $stream=\"beacon.connections\",\n        $apply=set(SumStats::SUM)\n    );\n\n    SumStats::create([\n        $name=\"detect-beaconing\",\n        $epoch=observation_window,\n        $reducers=set(r1),\n        $threshold_val(key: SumStats::Key, result: SumStats::Result) = {\n            return result[\"beacon.connections\"]$sum;\n        },\n        $threshold=beacon_threshold + 0.0,\n        $threshold_crossed(key: SumStats::Key, result: SumStats::Result) = {\n            NOTICE([\n                $note=Possible_Beaconing,\n                $msg=fmt(\"Possible beaconing: %s made %d connections in %s\",\n                         key$str, result[\"beacon.connections\"]$sum, observation_window),\n                $identifier=key$str\n            ]);\n        }\n    ]);\n}\n\nevent connection_state_remove(c: connection)\n{\n    if ( c$id$resp_h !in Site::local_nets )\n    {\n        local key = fmt(\"%s->%s:%d\", c$id$orig_h, c$id$resp_h, c$id$resp_p);\n        SumStats::observe(\"beacon.connections\", [$str=key], [$num=1]);\n    }\n}\n```\n\n### Step 4: Load Custom Scripts and Deploy\n\n```bash\n# Add custom scripts to local.zeek\nsudo tee -a \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Flocal.zeek \u003C\u003C 'EOF'\n\n# Custom detection scripts\n@load custom-detections\u002Fdns-tunneling.zeek\n@load custom-detections\u002Fbeacon-detection.zeek\n\n# Enable additional protocol analyzers\n@load protocols\u002Fftp\u002Fsoftware\n@load protocols\u002Fhttp\u002Fsoftware\n@load protocols\u002Fsmtp\u002Fsoftware\n@load protocols\u002Fssh\u002Fdetect-bruteforcing\n@load protocols\u002Fssl\u002Fvalidate-certs\n@load protocols\u002Fssl\u002Flog-hostcerts-only\n@load protocols\u002Fdns\u002Fdetect-external-names\n\n# Enable file extraction\n@load frameworks\u002Ffiles\u002Fextract-all-files\n\n# Enable Intel framework for threat intelligence\n@load frameworks\u002Fintel\u002Fseen\n@load frameworks\u002Fintel\u002Fdo_notice\nEOF\n\n# Reload Zeek configuration\nsudo zeekctl deploy\n\n# Verify scripts loaded without errors\nsudo zeekctl diag\n```\n\n### Step 5: Threat Hunting Queries on Zeek Logs\n\n```bash\n# Find long-duration connections (possible C2)\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration | \\\n  awk '$5 > 3600 {print $0}' | sort -t$'\\t' -k5 -rn | head -20\n\n# Find connections with high data transfer volumes\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut ts id.orig_h id.resp_h orig_bytes resp_bytes | \\\n  awk '$4 > 100000000 || $5 > 100000000 {print $0}'\n\n# Identify rare user agents (potential malware)\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fhttp.log | zeek-cut user_agent | sort | uniq -c | sort -n | head -20\n\n# Find self-signed or expired certificates\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fssl.log | zeek-cut ts id.orig_h id.resp_h server_name validation_status | \\\n  grep -v \"ok\"\n\n# Detect DNS queries to newly registered domains (DGA patterns)\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdns.log | zeek-cut ts id.orig_h query | \\\n  awk -F'\\t' '{n=split($3,a,\".\"); if(length(a[n-1]) > 10) print $0}'\n\n# Find SSH brute force attempts\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fssh.log | zeek-cut ts id.orig_h id.resp_h auth_success | \\\n  grep \"F\" | awk '{print $2}' | sort | uniq -c | sort -rn | head -10\n\n# Identify unusual port usage\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut id.resp_p proto service | \\\n  sort | uniq -c | sort -rn | head -50\n```\n\n### Step 6: Integrate with SIEM and Set Up Alerting\n\n```bash\n# Configure JSON log output for SIEM ingestion\nsudo tee \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fjson-logs.zeek \u003C\u003C 'EOF'\n@load policy\u002Ftuning\u002Fjson-logs.zeek\nredef LogAscii::use_json = T;\nEOF\n\n# Forward logs to Elastic via Filebeat\n# \u002Fetc\u002Ffilebeat\u002Ffilebeat.yml\nsudo tee \u002Fetc\u002Ffilebeat\u002Ffilebeat.yml \u003C\u003C 'EOF'\nfilebeat.inputs:\n  - type: log\n    enabled: true\n    paths:\n      - \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F*.log\n    json.keys_under_root: true\n    json.add_error_key: true\n    fields:\n      source: zeek\n    fields_under_root: true\n\noutput.elasticsearch:\n  hosts: [\"https:\u002F\u002Felastic-siem:9200\"]\n  index: \"zeek-%{+yyyy.MM.dd}\"\n  username: \"elastic\"\n  password: \"${ES_PASSWORD}\"\nEOF\n\nsudo systemctl enable --now filebeat\n\n# Set up log rotation\nsudo tee \u002Fetc\u002Fcron.d\u002Fzeek-logrotate \u003C\u003C 'EOF'\n0 0 * * * root \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl cron\nEOF\n\n# Monitor Zeek health\nsudo zeekctl status\nsudo zeekctl netstats\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Network Security Monitor** | Passive analysis tool that observes network traffic and generates structured metadata logs without altering or blocking traffic flow |\n| **Zeek Script** | Event-driven scripts written in Zeek's domain-specific language that process network events and generate notices, logs, and metrics |\n| **Connection Log (conn.log)** | Core Zeek log recording every observed connection with source\u002Fdestination IPs, ports, protocol, duration, and byte counts |\n| **Notice Framework** | Zeek subsystem for generating alerts when detection scripts identify suspicious activity, outputting to notice.log |\n| **SumStats Framework** | Statistical analysis framework in Zeek for tracking metrics over time windows, enabling threshold-based detection of anomalies |\n| **Intel Framework** | Zeek module for matching observed network indicators against threat intelligence feeds and generating alerts on matches |\n\n## Tools & Systems\n\n- **Zeek 6.0+**: Open-source network security monitor generating comprehensive protocol-level logs from passive traffic analysis\n- **zeek-cut**: Zeek utility for extracting specific columns from tab-separated Zeek log files for quick analysis\n- **zeekctl**: Zeek management tool for deploying, monitoring, and managing Zeek instances across single or clustered deployments\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool that analyzes Zeek logs for beaconing, DNS tunneling, and other threat indicators\n- **Filebeat**: Elastic agent for shipping Zeek JSON logs to Elasticsearch for centralized analysis and visualization\n\n## Common Scenarios\n\n### Scenario: Detecting Command-and-Control Beaconing in Enterprise Traffic\n\n**Context**: A threat intelligence report indicates that a specific threat actor uses HTTPS beaconing with 60-second intervals to compromised hosts. The SOC team needs to analyze Zeek logs to identify any hosts exhibiting this pattern across the enterprise network carrying 2 Gbps of traffic.\n\n**Approach**:\n1. Deploy Zeek on a network tap at the internet egress point with AF_PACKET for high-throughput capture\n2. Enable the custom beacon detection script with thresholds tuned for 60-second intervals over 1-hour observation windows\n3. Query conn.log for connections to external IPs with consistent duration and inter-connection timing: filter connections where the standard deviation of inter-arrival times is less than 5 seconds\n4. Cross-reference suspicious destination IPs against threat intelligence feeds loaded into Zeek's Intel framework\n5. Examine ssl.log for the associated TLS certificates -- check for self-signed certificates, unusual issuer names, or certificates with short validity periods\n6. Generate a notice for each identified beaconing source and feed into the SIEM for SOC triage\n\n**Pitfalls**:\n- Not tuning beacon detection thresholds for the environment, resulting in false positives from legitimate update services (Windows Update, AV updates)\n- Failing to exclude CDN and cloud service provider IP ranges that naturally receive many repeat connections\n- Running Zeek without sufficient CPU cores, causing packet drops on high-throughput links\n- Not enabling JSON log output, making SIEM integration unnecessarily complex with custom parsers\n\n## Output Format\n\n```\n## Zeek Network Anomaly Detection Report\n\n**Sensor**: zeek-sensor-01 (10.10.1.250)\n**Monitoring Interface**: eth1 (span port from Core-SW1)\n**Analysis Period**: 2024-03-15 00:00 to 2024-03-16 00:00 UTC\n**Total Connections Logged**: 2,847,392\n\n### Anomalies Detected\n\n| Notice Type | Source | Destination | Details |\n|-------------|--------|-------------|---------|\n| DNS_Tunneling_Detected | 10.10.3.45 | 8.8.8.8 | 847 queries to suspect-domain.xyz in 5 min |\n| Possible_Beaconing | 10.10.5.12 | 203.0.113.50:443 | 62 connections with 59.8s avg interval |\n| SSL::Invalid_Server_Cert | 10.10.8.22 | 198.51.100.33:443 | Self-signed cert, CN=localhost |\n| SSH::Password_Guessing | 45.33.32.156 | 10.10.20.11:22 | 487 failed attempts in 30 min |\n\n### Recommendations\n1. Isolate 10.10.3.45 and investigate for DNS tunneling malware\n2. Block 203.0.113.50 at firewall and forensically image 10.10.5.12\n3. Investigate self-signed TLS certificate on 198.51.100.33\n4. Block 45.33.32.156 and enforce SSH key-only authentication\n```\n","# Detecting Network Anomalies with Zeek\n\n## When to Use\n\n- Deploying passive network security monitoring at key network choke points for continuous visibility\n- Generating structured connection, DNS, HTTP, SSL, and file transfer logs for SIEM ingestion and threat hunting\n- Writing custom Zeek scripts to detect organization-specific threats, policy violations, or beaconing behavior\n- Performing retrospective analysis on network metadata to investigate security incidents\n- Complementing IDS solutions with protocol-level metadata analysis that signature-based tools may miss\n\n**Do not use** as a replacement for inline IDS\u002FIPS that can actively block traffic, for monitoring encrypted payloads without TLS inspection, or on endpoints where host-based agents are more appropriate.\n\n## Prerequisites\n\n- Zeek 6.0+ installed from source or package manager (`zeek --version`)\n- Network interface configured on a span port, network tap, or virtual switch mirror for passive capture\n- Sufficient disk storage for log files (estimate 1-5 GB\u002Fday per 100 Mbps of monitored traffic)\n- Familiarity with Zeek's scripting language for writing custom detections\n- Log aggregation system (Splunk, Elastic, Graylog) for centralized analysis\n\n## Workflow\n\n### Step 1: Install and Configure Zeek\n\n```bash\n# Install Zeek on Ubuntu\u002FDebian\nsudo apt install -y zeek\n\n# Or install from source for latest version\ngit clone --recursive https:\u002F\u002Fgithub.com\u002Fzeek\u002Fzeek\ncd zeek && .\u002Fconfigure --prefix=\u002Fopt\u002Fzeek && make -j$(nproc) && sudo make install\nexport PATH=\u002Fopt\u002Fzeek\u002Fbin:$PATH\n\n# Configure the monitoring interface\nsudo vi \u002Fopt\u002Fzeek\u002Fetc\u002Fnode.cfg\n```\n\n```ini\n# \u002Fopt\u002Fzeek\u002Fetc\u002Fnode.cfg\n[zeek]\ntype=standalone\nhost=localhost\ninterface=eth1\n```\n\n```bash\n# Configure local network definitions\nsudo vi \u002Fopt\u002Fzeek\u002Fetc\u002Fnetworks.cfg\n```\n\n```\n# \u002Fopt\u002Fzeek\u002Fetc\u002Fnetworks.cfg\n10.0.0.0\u002F8       Internal\n172.16.0.0\u002F12    Internal\n192.168.0.0\u002F16   Internal\n```\n\n```bash\n# Disable NIC offloading for accurate packet capture\nsudo ethtool -K eth1 rx off tx off gro off lro off tso off gso off\n\n# Deploy Zeek\nsudo zeekctl deploy\n\n# Verify Zeek is running\nsudo zeekctl status\n```\n\n### Step 2: Understand and Navigate Zeek Logs\n\n```bash\n# Zeek generates structured log files in \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\nls \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F\n\n# Key log files:\n# conn.log       - All network connections (TCP, UDP, ICMP)\n# dns.log        - DNS queries and responses\n# http.log       - HTTP requests and responses\n# ssl.log        - SSL\u002FTLS handshake details\n# files.log      - File transfers observed on the network\n# notice.log     - Alerts from Zeek detection scripts\n# weird.log      - Protocol anomalies and errors\n# x509.log       - X.509 certificate details\n# smtp.log       - SMTP email transactions\n# ssh.log        - SSH connection details\n\n# View connection log with zeek-cut for column selection\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut ts id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes\n\n# View DNS log\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdns.log | zeek-cut ts id.orig_h query qtype_name answers\n\n# View HTTP log\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fhttp.log | zeek-cut ts id.orig_h host uri method status_code user_agent\n```\n\n### Step 3: Write Custom Detection Scripts\n\n```bash\n# Create a custom detection script directory\nsudo mkdir -p \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fcustom-detections\n```\n\nCreate a script for detecting DNS tunneling:\n\n```zeek\n# \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fcustom-detections\u002Fdns-tunneling.zeek\n@load base\u002Fframeworks\u002Fnotice\n\nmodule DNSTunneling;\n\nexport {\n    redef enum Notice::Type += {\n        DNS_Tunneling_Detected,\n        DNS_Long_Query\n    };\n\n    # Threshold: number of unique queries per source in time window\n    const query_threshold: count = 200 &redef;\n    const time_window: interval = 5min &redef;\n    const max_query_length: count = 50 &redef;\n}\n\n# Track query counts per source IP\nglobal dns_query_counts: table[addr] of count &create_expire=5min &default=0;\n\nevent dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)\n{\n    local src = c$id$orig_h;\n\n    # Check for unusually long domain queries (base64-encoded data)\n    if ( |query| > max_query_length )\n    {\n        NOTICE([\n            $note=DNS_Long_Query,\n            $msg=fmt(\"Unusually long DNS query from %s: %s (%d chars)\", src, query, |query|),\n            $src=src,\n            $identifier=cat(src, query)\n        ]);\n    }\n\n    # Track query volume per source\n    dns_query_counts[src] += 1;\n\n    if ( dns_query_counts[src] == query_threshold )\n    {\n        NOTICE([\n            $note=DNS_Tunneling_Detected,\n            $msg=fmt(\"Possible DNS tunneling: %s sent %d queries in %s\", src, query_threshold, time_window),\n            $src=src,\n            $identifier=cat(src)\n        ]);\n    }\n}\n```\n\nCreate a script for detecting beaconing:\n\n```zeek\n# \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fcustom-detections\u002Fbeacon-detection.zeek\n@load base\u002Fframeworks\u002Fnotice\n@load base\u002Fframeworks\u002Fsumstats\n\nmodule BeaconDetection;\n\nexport {\n    redef enum Notice::Type += {\n        Possible_Beaconing\n    };\n\n    const beacon_threshold: count = 50 &redef;\n    const observation_window: interval = 1hr &redef;\n}\n\nevent zeek_init()\n{\n    local r1 = SumStats::Reducer(\n        $stream=\"beacon.connections\",\n        $apply=set(SumStats::SUM)\n    );\n\n    SumStats::create([\n        $name=\"detect-beaconing\",\n        $epoch=observation_window,\n        $reducers=set(r1),\n        $threshold_val(key: SumStats::Key, result: SumStats::Result) = {\n            return result[\"beacon.connections\"]$sum;\n        },\n        $threshold=beacon_threshold + 0.0,\n        $threshold_crossed(key: SumStats::Key, result: SumStats::Result) = {\n            NOTICE([\n                $note=Possible_Beaconing,\n                $msg=fmt(\"Possible beaconing: %s made %d connections in %s\",\n                         key$str, result[\"beacon.connections\"]$sum, observation_window),\n                $identifier=key$str\n            ]);\n        }\n    ]);\n}\n\nevent connection_state_remove(c: connection)\n{\n    if ( c$id$resp_h !in Site::local_nets )\n    {\n        local key = fmt(\"%s->%s:%d\", c$id$orig_h, c$id$resp_h, c$id$resp_p);\n        SumStats::observe(\"beacon.connections\", [$str=key], [$num=1]);\n    }\n}\n```\n\n### Step 4: Load Custom Scripts and Deploy\n\n```bash\n# Add custom scripts to local.zeek\nsudo tee -a \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Flocal.zeek \u003C\u003C 'EOF'\n\n# Custom detection scripts\n@load custom-detections\u002Fdns-tunneling.zeek\n@load custom-detections\u002Fbeacon-detection.zeek\n\n# Enable additional protocol analyzers\n@load protocols\u002Fftp\u002Fsoftware\n@load protocols\u002Fhttp\u002Fsoftware\n@load protocols\u002Fsmtp\u002Fsoftware\n@load protocols\u002Fssh\u002Fdetect-bruteforcing\n@load protocols\u002Fssl\u002Fvalidate-certs\n@load protocols\u002Fssl\u002Flog-hostcerts-only\n@load protocols\u002Fdns\u002Fdetect-external-names\n\n# Enable file extraction\n@load frameworks\u002Ffiles\u002Fextract-all-files\n\n# Enable Intel framework for threat intelligence\n@load frameworks\u002Fintel\u002Fseen\n@load frameworks\u002Fintel\u002Fdo_notice\nEOF\n\n# Reload Zeek configuration\nsudo zeekctl deploy\n\n# Verify scripts loaded without errors\nsudo zeekctl diag\n```\n\n### Step 5: Threat Hunting Queries on Zeek Logs\n\n```bash\n# Find long-duration connections (possible C2)\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p duration | \\\n  awk '$5 > 3600 {print $0}' | sort -t$'\\t' -k5 -rn | head -20\n\n# Find connections with high data transfer volumes\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut ts id.orig_h id.resp_h orig_bytes resp_bytes | \\\n  awk '$4 > 100000000 || $5 > 100000000 {print $0}'\n\n# Identify rare user agents (potential malware)\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fhttp.log | zeek-cut user_agent | sort | uniq -c | sort -n | head -20\n\n# Find self-signed or expired certificates\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fssl.log | zeek-cut ts id.orig_h id.resp_h server_name validation_status | \\\n  grep -v \"ok\"\n\n# Detect DNS queries to newly registered domains (DGA patterns)\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fdns.log | zeek-cut ts id.orig_h query | \\\n  awk -F'\\t' '{n=split($3,a,\".\"); if(length(a[n-1]) > 10) print $0}'\n\n# Find SSH brute force attempts\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fssh.log | zeek-cut ts id.orig_h id.resp_h auth_success | \\\n  grep \"F\" | awk '{print $2}' | sort | uniq -c | sort -rn | head -10\n\n# Identify unusual port usage\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fconn.log | zeek-cut id.resp_p proto service | \\\n  sort | uniq -c | sort -rn | head -50\n```\n\n### Step 6: Integrate with SIEM and Set Up Alerting\n\n```bash\n# Configure JSON log output for SIEM ingestion\nsudo tee \u002Fopt\u002Fzeek\u002Fshare\u002Fzeek\u002Fsite\u002Fjson-logs.zeek \u003C\u003C 'EOF'\n@load policy\u002Ftuning\u002Fjson-logs.zeek\nredef LogAscii::use_json = T;\nEOF\n\n# Forward logs to Elastic via Filebeat\n# \u002Fetc\u002Ffilebeat\u002Ffilebeat.yml\nsudo tee \u002Fetc\u002Ffilebeat\u002Ffilebeat.yml \u003C\u003C 'EOF'\nfilebeat.inputs:\n  - type: log\n    enabled: true\n    paths:\n      - \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002F*.log\n    json.keys_under_root: true\n    json.add_error_key: true\n    fields:\n      source: zeek\n    fields_under_root: true\n\noutput.elasticsearch:\n  hosts: [\"https:\u002F\u002Felastic-siem:9200\"]\n  index: \"zeek-%{+yyyy.MM.dd}\"\n  username: \"elastic\"\n  password: \"${ES_PASSWORD}\"\nEOF\n\nsudo systemctl enable --now filebeat\n\n# Set up log rotation\nsudo tee \u002Fetc\u002Fcron.d\u002Fzeek-logrotate \u003C\u003C 'EOF'\n0 0 * * * root \u002Fopt\u002Fzeek\u002Fbin\u002Fzeekctl cron\nEOF\n\n# Monitor Zeek health\nsudo zeekctl status\nsudo zeekctl netstats\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Network Security Monitor** | Passive analysis tool that observes network traffic and generates structured metadata logs without altering or blocking traffic flow |\n| **Zeek Script** | Event-driven scripts written in Zeek's domain-specific language that process network events and generate notices, logs, and metrics |\n| **Connection Log (conn.log)** | Core Zeek log recording every observed connection with source\u002Fdestination IPs, ports, protocol, duration, and byte counts |\n| **Notice Framework** | Zeek subsystem for generating alerts when detection scripts identify suspicious activity, outputting to notice.log |\n| **SumStats Framework** | Statistical analysis framework in Zeek for tracking metrics over time windows, enabling threshold-based detection of anomalies |\n| **Intel Framework** | Zeek module for matching observed network indicators against threat intelligence feeds and generating alerts on matches |\n\n## Tools & Systems\n\n- **Zeek 6.0+**: Open-source network security monitor generating comprehensive protocol-level logs from passive traffic analysis\n- **zeek-cut**: Zeek utility for extracting specific columns from tab-separated Zeek log files for quick analysis\n- **zeekctl**: Zeek management tool for deploying, monitoring, and managing Zeek instances across single or clustered deployments\n- **RITA (Real Intelligence Threat Analytics)**: Open-source tool that analyzes Zeek logs for beaconing, DNS tunneling, and other threat indicators\n- **Filebeat**: Elastic agent for shipping Zeek JSON logs to Elasticsearch for centralized analysis and visualization\n\n## Common Scenarios\n\n### Scenario: Detecting Command-and-Control Beaconing in Enterprise Traffic\n\n**Context**: A threat intelligence report indicates that a specific threat actor uses HTTPS beaconing with 60-second intervals to compromised hosts. The SOC team needs to analyze Zeek logs to identify any hosts exhibiting this pattern across the enterprise network carrying 2 Gbps of traffic.\n\n**Approach**:\n1. Deploy Zeek on a network tap at the internet egress point with AF_PACKET for high-throughput capture\n2. Enable the custom beacon detection script with thresholds tuned for 60-second intervals over 1-hour observation windows\n3. Query conn.log for connections to external IPs with consistent duration and inter-connection timing: filter connections where the standard deviation of inter-arrival times is less than 5 seconds\n4. Cross-reference suspicious destination IPs against threat intelligence feeds loaded into Zeek's Intel framework\n5. Examine ssl.log for the associated TLS certificates -- check for self-signed certificates, unusual issuer names, or certificates with short validity periods\n6. Generate a notice for each identified beaconing source and feed into the SIEM for SOC triage\n\n**Pitfalls**:\n- Not tuning beacon detection thresholds for the environment, resulting in false positives from legitimate update services (Windows Update, AV updates)\n- Failing to exclude CDN and cloud service provider IP ranges that naturally receive many repeat connections\n- Running Zeek without sufficient CPU cores, causing packet drops on high-throughput links\n- Not enabling JSON log output, making SIEM integration unnecessarily complex with custom parsers\n\n## Output Format\n\n```\n## Zeek Network Anomaly Detection Report\n\n**Sensor**: zeek-sensor-01 (10.10.1.250)\n**Monitoring Interface**: eth1 (span port from Core-SW1)\n**Analysis Period**: 2024-03-15 00:00 to 2024-03-16 00:00 UTC\n**Total Connections Logged**: 2,847,392\n\n### Anomalies Detected\n\n| Notice Type | Source | Destination | Details |\n|-------------|--------|-------------|---------|\n| DNS_Tunneling_Detected | 10.10.3.45 | 8.8.8.8 | 847 queries to suspect-domain.xyz in 5 min |\n| Possible_Beaconing | 10.10.5.12 | 203.0.113.50:443 | 62 connections with 59.8s avg interval |\n| SSL::Invalid_Server_Cert | 10.10.8.22 | 198.51.100.33:443 | Self-signed cert, CN=localhost |\n| SSH::Password_Guessing | 45.33.32.156 | 10.10.20.11:22 | 487 failed attempts in 30 min |\n\n### Recommendations\n1. Isolate 10.10.3.45 and investigate for DNS tunneling malware\n2. Block 203.0.113.50 at firewall and forensically image 10.10.5.12\n3. Investigate self-signed TLS certificate on 198.51.100.33\n4. Block 45.33.32.156 and enforce SSH key-only authentication\n```\n",{"name":5,"tags":52,"author":55,"domain":46,"license":15,"version":56,"nist_csf":57,"subdomain":34,"description":7,"mitre_attack":62},[34,53,31,54,30],"zeek","anomaly-detection","mahipal","1.0",[58,59,60,61],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[63,64,65,66],"T1046","T1040","T1557","T1071","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-network-anomalies-with-zeek",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-network-anomalies-with-zeek",{"tool":83,"command":84},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-network-anomalies-with-zeek",{"tool":86,"command":87},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-network-anomalies-with-zeek","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-anomalies-with-zeek\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-anomalies-with-zeek\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",2550,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-anomalies-with-zeek\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",11389,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-network-anomalies-with-zeek\u002Fscripts\u002Fagent.py",[109,133,157,185,210,237],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":116,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[115],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[117,118,119,120,37,46,45,121,41,122,123,124,125,126,127,128,129,130,131,132],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[139],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[141,129,142,143,37,144,46,41,145,146,147,148,149,150,151,152,153,154,155,156],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":167,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[151,168,169,170,171,46,172,173,145,174,175,176,177,178,179,180,181,182,183,184],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[191],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,46,196,197,39,198,199,200,201,202,203,204,205,206,148,207,208,209],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":217,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[216],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[218,219,220,46,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[243],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[37,245,46,44,246,247,248,249,250,251,252,180,253,181,254,255,256,257,258,259],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]