A former FOR572 student, John D, helfully provided some useful command lines that you might be able to take advantage of, specifically while parsing Zeek's log files when created in JSON format. These commands use the jq
utility, which is widely available for most operating systems. Another useful resource is the JSON and jq
Quick Start Guide, which is used in FOR572 and provided as a public resource.
Querying Zeek files:
dce_rpc.log
cat dce_rpc.log | jq '{ operation, "named_pipe", endpoint, ts, "id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p"}'
- Example output:
{ "operation": "NetrShareGetInfo", "named_pipe": "\\PIPE\\srvsvc",