Lion Cipher Lab
Turn packet captures into structured logs with Zeek
- SOC Analyst / Blue Team
- Beginner
- ~45 min
- Free · no account required
Why it matters
Reading a capture packet by packet in Wireshark is great for a deep look at one conversation, but it does not scale — no SOC analyst reads a million packets by hand. Zeek is how real network monitoring works at scale: it watches traffic (live or from a pcap) and writes compact, protocol-aware logs — one tidy record per connection, per DNS query, per HTTP request, per TLS handshake — instead of raw bytes. Those structured logs are what detections, threat hunts, and SIEM searches actually run against. Learning to produce and read Zeek logs is a core, employable SOC and network-monitoring skill,…
What you'll learn
- understanding protocol-aware logs vs raw packets
- installing Zeek
- running Zeek over a saved pcap (zeek -r)
- reading conn.log, dns.log, http.log and ssl.log
- slicing logs with zeek-cut
- seeing how network logs feed hunting and detection
Steps in this lab
- What Zeek is — logs, not packets
- Install Zeek
- Get traffic you own to work with
- Run Zeek over your pcap
- Read conn.log — the backbone log
- Read dns.log and http.log — names and web requests
- Read ssl.log — visibility into encrypted traffic
- Why log-driven monitoring is the SOC skill