Search Zeek connection logs with flexible filters. Supports CIDR notation for IPs, connection state filtering, duration/byte thresholds, and time ranges.

Get statistical summary of connections over a time period - top talkers, services, bytes, and connection counts.

Find unusually long-lived connections that may indicate C2 beacons, tunnels, or persistent backdoors.

Search Zeek DNS query logs. Supports wildcard domain matching, query type filtering, and response code filtering.

DNS query statistics - top queried domains, NXDOMAIN counts (potential DGA detection), query type distribution, and top DNS clients.

Detect potential DNS tunneling by analyzing query entropy, subdomain lengths, and TXT/NULL query volumes.

Search Zeek HTTP request logs. Supports wildcard matching on host and URI, user agent filtering, and status code filtering.

Find suspicious HTTP activity including POSTs to raw IPs, unusual user agents, large POST bodies, requests to high ports, and base64 in URLs.

Search Zeek SSL/TLS connection logs. Filter by SNI hostname, TLS version, certificate validation status, subject, and issuer.

Find connections using expired or self-signed certificates - potential indicators of man-in-the-middle or malicious infrastructure.

Search Zeek file extraction logs. Filter by MIME type, filename, hash values, source IP, and file size.

Find executable file transfers on the network - PE, ELF, Mach-O binaries and scripts that may indicate malware delivery.

Search Zeek security notices (built-in and custom detections). Notices include port scans, invalid certificates, protocol violations, and custom alerts.

Search Zeek SSH connection logs. Filter by source/destination IP, authentication status, and connection direction.

Detect SSH brute force attempts by identifying sources with multiple failed authentication attempts exceeding a threshold.

Comprehensive investigation of all activity for a specific host across all Zeek log types - connections, DNS, HTTP, SSL, files, notices, SSH, and software.

Follow a specific connection UID across all Zeek log types to reconstruct the complete session lifecycle.

List detected software and versions on the network from Zeek's protocol analysis. Useful for asset discovery and vulnerability assessment.

Search Zeek DHCP logs for lease assignments, device discovery, and hostname-to-IP mapping. Useful for asset inventory and identifying rogue devices.

Build an asset map from DHCP logs: MAC address to IP/hostname mappings. Useful for identifying all devices on the network and spotting unknown/rogue devices.

Detect potential C2 beaconing by analyzing connection interval regularity. Finds source-destination pairs with suspiciously consistent callback intervals (low jitter). Higher scores indicate more regular beaconing patterns.

Run statistical anomaly detection across connection logs. Detects port scanning, data exfiltration (statistical outliers in bytes sent), and high-volume connections to unusual ports without identified services.

Extract and analyze JA3/JA3S TLS fingerprints from SSL logs. Identifies client TLS implementations and can detect known malicious fingerprints. JA3 fingerprints persist even when domains/IPs change, making them valuable for tracking threat actors.

Hunt for known malicious JA3 fingerprints across SSL logs. Compares all observed JA3 hashes against a built-in database of malware families (CobaltStrike, Emotet, TrickBot, etc.) and returns any matches.

Generate a statistical baseline of normal network activity. Calculates averages, standard deviations, and distributions for connections, bytes, services, and protocols. Use as a reference point to identify deviations that may indicate compromise.

Compare current network activity against a baseline and identify statistical outliers. Flags hosts with unusual byte volumes, connection counts, port diversity, or timing patterns that deviate significantly from the norm.

Search Suricata IDS/IPS alerts from eve.json. Filter by signature, severity, source/destination IP, protocol, and time range. Returns the most recent alerts matching the criteria.

Get a high-level summary of Suricata alerts: top signatures, categories, severity distribution, top source/destination IPs, and alert timeline.

Cross-reference a Suricata alert with Zeek logs using community_id or IP/port/time matching. Returns the Suricata alert details alongside instructions to investigate the same flow in Zeek.

Get Suricata engine statistics from eve.json stats events: packet counts, decoder stats, flow metrics, and detection engine performance.

List available PCAP files in the capture directory with file sizes and timestamps.

Replay a PCAP file through Zeek and return the generated log summary. Creates connection, DNS, HTTP, SSL, and other logs from the packet capture. Useful for forensic analysis of captured traffic.

Create a TheHive alert from NIDS findings. Includes observables (IPs, domains, hashes), severity, TLP marking, and alert description. Use after investigating suspicious activity in Zeek/Suricata logs.

Create a TheHive case for in-depth investigation. Escalate from alerts or create directly from significant NIDS findings. Cases support tasks, observables, and collaborative investigation.

Search existing TheHive cases and alerts. Find related investigations, check for duplicates, or review open cases.

Search MISP for indicators of compromise (IOCs). Look up IPs, domains, hashes, URLs, and other observables against MISP's threat intelligence database. Returns matching events, attributes, and context.

Check multiple IOCs against MISP in a single call. Useful for batch-checking IPs, domains, or hashes found during Zeek/Suricata analysis.

Create a MISP event from NIDS findings to share threat intelligence. Includes attributes (IOCs), tags, and threat level classification.

Get the current status of the NIDS sensor: available Zeek log files with sizes, record counts, and freshness. Also checks Suricata eve.json status. Use this to understand what data is available before running queries.