Zeek Becoming Part of Microsoft Windows (corelight.com) 21
First released in 1998, the BSD-licensed software Zeek (originally named "Bro") is about to get more widely adopted, writes long-time Slashdot reader skinfaxi:
Zeek, the open source network security monitoring platform, is being integrated into Windows and "is now deployed on more than one billion global endpoints," according to an announcement from Corelight.
From Corelight's press release: Corelight, the leader in open network detection and response, today announced the integration of Zeek, the world's most popular open source network security monitoring platform, as a component of Microsoft Windows and Defender for Endpoint. The integration will help security teams respond to the most challenging attacks by providing "richer signals for advanced threat hunting, complete and accurate discovery of IoT devices, and more powerful detection and response capabilities."
Originally created by Corelight co-founder and chief scientist Dr. Vern Paxson while at Lawrence Berkeley National Laboratory, Zeek transforms network traffic into compact and high-fidelity logs, file content, and behavioral analytics to accelerate security operations. Vital funding for Zeek came initially from the National Science Foundation and the US Department of Energy's Office of Science. As adoption increased, Corelight was founded to provide a financial model and corporate sponsor for the project....
"Microsoft is strongly committed to supporting open source projects and ecosystems," said Rob Lefferts, corporate vice president for Microsoft. "We're proud to be working with Zeek and are thrilled to bring this level of network intelligence and monitoring to our customers."
"This is an amazing development for Zeek and its community of contributors and users," said Paxson. "I never imagined that the tool I developed for network monitoring would find broader application in defending endpoints — but that's part of the creative magic of open source development.
"We are grateful for Microsoft's contributions and support, and we are excited that the project's impact, and that of the community of contributors, will increase so dramatically."
From Corelight's press release: Corelight, the leader in open network detection and response, today announced the integration of Zeek, the world's most popular open source network security monitoring platform, as a component of Microsoft Windows and Defender for Endpoint. The integration will help security teams respond to the most challenging attacks by providing "richer signals for advanced threat hunting, complete and accurate discovery of IoT devices, and more powerful detection and response capabilities."
Originally created by Corelight co-founder and chief scientist Dr. Vern Paxson while at Lawrence Berkeley National Laboratory, Zeek transforms network traffic into compact and high-fidelity logs, file content, and behavioral analytics to accelerate security operations. Vital funding for Zeek came initially from the National Science Foundation and the US Department of Energy's Office of Science. As adoption increased, Corelight was founded to provide a financial model and corporate sponsor for the project....
"Microsoft is strongly committed to supporting open source projects and ecosystems," said Rob Lefferts, corporate vice president for Microsoft. "We're proud to be working with Zeek and are thrilled to bring this level of network intelligence and monitoring to our customers."
"This is an amazing development for Zeek and its community of contributors and users," said Paxson. "I never imagined that the tool I developed for network monitoring would find broader application in defending endpoints — but that's part of the creative magic of open source development.
"We are grateful for Microsoft's contributions and support, and we are excited that the project's impact, and that of the community of contributors, will increase so dramatically."
Microsoft being Microsoft (Score:3)
Re: (Score:3)
My first thought...
Re: Microsoft being Microsoft (Score:2)
Re: (Score:3)
that's unfair, skype was considerably crappy software long before microsoft bought it. e.g. as a pure chat client, ms messenger was way better and more stable than skype. the days of chat clients were counted though, and skype simply got first to the voip game and had a huge userbase. that's what several companies paid billions for, not the tech.
Re: (Score:2)
And yet BSD and Linux still exists, and widely used by them. [youtu.be] Looks like that motto might have to be replaced by embrace, extend, profit.
Re: (Score:2)
Re: (Score:2)
Lol, you dweebs are really really stuck in 1992, when someone said that and now you all think it's true. It's like some bizarre memetic mantra you all just keep repeating as a sort of dweeby-nerd virtue signalling.
It's a meaningless slogan and has nothing to do with how Microsoft operates. Or wait, did I miss something and have they extinguished Linux or anything else by this nefarious scheme of EEE you imagine they plot in the dark back rooms?
Re: Microsoft being Microsoft (Score:1)
They effectively killed Linux with SystemD and PulseAudio, Poettering is being paid by Microsoft after all.
The problem with Windows Defender (Score:5, Insightful)
Re:The problem with Windows Defender (Score:4, Insightful)
Re: (Score:3)
If you're got Defender for Endpoint running on your computer, chances are pretty good that it ain't your computer, but your employer's, and it was installed as part of a management package (InTune or otherwise). And yes, they do call home about every little thing. Again, company rules and if you don't like them, you're free to work elsewhere.
I have about 3000 devices under our tenant's AAD/InTune management and Defender for Endpoint has been very instructive, especially since most of my users are mostly rem
Re: (Score:1)
When literally everywhere of the handful of oligopolies in any given industry all do the same thing - no you're not free to go elsewhere.
Having a different logo doesn't mean you're treated differently - much less better. They all follow the same "meta", the same HR bullshit, the same insurance companies mandating whatever dumb fuck security theater of the week "security" practice you're required to do in the roughly the same way as taking your shoes off at the airport is somehow supposed to make you safer.
Re: (Score:1)
Yes. If there's one hallmark of good security software it's permissiveness. If it doesn't know what something is or something is only a little suspicious, the best security software in the world leaves it alone, especially if it's something it thinks the user might want.
If my sarcasm wasn't heavy-handed enough, let me make it clear I'm mocking your argument heavily.
Zeek (Score:2)
Can't say I've even heard of this - does anyone here actually use it? Other than the Corelight employee that submitted the story, I mean?
Re: (Score:2)
I'd never heard of it either, but it looks pretty cool. I think Snort is the big competitor and the de facto standard, and that's the only one I've heard of.
Re: (Score:3, Informative)
In a simple definition it like wireshark but for larger amounts of traffic. It produces files containing text of all the TCP/IP traffic and most protocols.
Re:Zeek (Score:4, Interesting)
Highly recommend trying it if you want to learn more or monitor your home network.
Zeek is not Snort, or anything like a signature based detection system. It parses the network traffic and writes different type of traffic into easily consumable text files (either text or json). In the Security Onion distro Zeek data is imported into Elasticsearch and accessed using Kibana. HTTP, SSH, DNS, DHCP, FTP, SNMP, SMTP, X509 certs being used, etc, etc, etc You can search for specifics or aggregate information in dashboards. Which device is doing what in what time period, or something like the most noisy device, or even figure out devices with scheduled connections (ex. IoT phone home devices). Security Onion can also store pcap files for the actual data traffic.
It's an awesome way to get to know your local network and to look into details on what is going on. Do you know what your Sonos speaker is doing on your network? What about your internet connected Coffeemaker?
As for Microsoft bringing Zeek into Defender, I'm not sure. They don't have anything even close to competing with Zeek and Microsoft seems to actually commit to open source these days. Really hope they don't ruin Zeek. It's awesome.
Old news from Ignite (Score:1)
I hope we are not getting a post about every tidbit that Microsoft released during Ignite this year, or it's gonna be a few hundred more posts :)
Ignite was over more than a week ago, this is old news?