<div dir="ltr">Hello,<div><br></div><div>The notice log would contain any information pertaining to the policy/protocols/ssh/detect-bruteforcing.zeek script.</div><div><br></div><div>However, I'm a little concerned by the nature of your task. Zeek isn't really designed as an "intrusion detection system" like Snort or Suricata. Is this a school project?</div><div><br></div><div>Sincerely,</div><div><br></div><div>Richard</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Oct 21, 2019 at 2:18 PM Borivoje Pavlovic <<a href="mailto:bpboci24@gmail.com">bpboci24@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi all,</div><div><br></div><div>I am beginner in Zeek. Currently, I have a task to perform analysis of . pcap files and detect all possible attacks per time instances. In the other words I have to test Zeek as an IDS tool and find with which percentage is Zeek able to classify traffic correctly (True/False positive, True/False negative indication). Is there possibility to do so? For example, I tried to run integrated Brute-Forcing.zeek script against my .pcap file but in the notice.log there is just note that there was an attack which is not what I am looking. Do I have to search for labeled network in some other logs? <br></div><div><br></div><div>Thanks in advance</div><div><br></div><div>Borivoje<br></div><div><br></div></div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">Richard Bejtlich<div>Principal Security Strategist, Corelight</div><div><a href="https://corelight.blog/author/richardbejtlich/" target="_blank">https://corelight.blog/author/richardbejtlich/</a><br></div></div></div></div></div></div></div>