agentsclimarketplace

Building zeek analytics for hunting

Skill meltedinhex/analyst-ai-pack/skills/building-zeek-analytics-for-hunting

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill building-zeek-analytics-for-hunting

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. Activates for requests to build Zeek analytics, write a Zeek hunting script, or analyze Zeek logs for threats.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, as published. Nobody here has run it

Building Zeek Analytics for Hunting

When to Use

  • You have Zeek logs (conn.log, dns.log, http.log, ssl.log, files.log) and want to build hunting analytics: long-lived connections, rare JA3 fingerprints, suspicious file downloads, and beaconing.
  • You want repeatable detections expressed as Zeek scripts or log-analysis queries.

Do not use Zeek to actively probe hosts — it is passive analysis of captured/sensor traffic.

Prerequisites

  • Zeek logs in TSV or JSON (or a running Zeek sensor). The script analyzes exported logs.

Workflow

Step 1: Analyze a Zeek log for anomalies

python scripts/analyst.py analyze conn.log --kind conn

For conn, surfaces long-duration and high-byte connections; for ssl, counts JA3 rarity; for http, flags executable/script downloads and rare user-agents; for dns, flags long/high-entropy queries.

Step 2: Express the logic as a Zeek script (optional)

Translate a confirmed pattern into a Zeek script using the appropriate event (connection_state_remove, ssl_established, http_reply).

Step 3: Confirm

Corroborate anomalies with destination reputation and other logs (pivot by uid).

Step 4: Operationalize

Stage the Zeek script or scheduled log query as a durable detection.

Validation

  • The analyzer parses both TSV (#fields) and JSON Zeek logs.
  • Surfaced anomalies match the chosen log kind's fields.
  • JA3 rarity and long-connection logic are computed correctly.

Pitfalls

  • TSV header (#fields) parsing — column order varies by deployment.
  • Backups/updates producing benign long/large connections.
  • JA3 collisions across legitimate clients.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.