Untagged on Ashour Blog

Zeek

Fri, 17 Apr 2026 14:34:26 +0200

Zeek is an open-source network traffic analyzer used to detect suspicious or malicious activity by scrutinizing network traffic.
Beyond security, it aids in troubleshooting network issues and performing network measurements.
Once deployed, Zeek provides defensive cybersecurity teams with extensive log files detailing network activity, including connection records and application-layer transcripts (e.g., DNS, HTTP).
Zeek also offers built-in functions for analyzing and detecting network activities.
Zeek’s powerful scripting language allows users to create custom scripts, similar to Suricata rules, enabling adaptable network analysis and intrusion detection.

Fri, 17 Apr 2026 14:34:19 +0200

Suricata is a robust, open-source network security engine for IDS, IPS, and NSM.
Developed and maintained by the OISF, it showcases the power of community-led, non-profit projects.
Suricata dissect/analyze all network traffic to find potential malicious activity.
It can broadly:
- Assess the network’s health/condition.
- Also investigate specific application-level interactions.
Suricata uses a detailed set of rules to guide its analysis, helping it identify possible threats.
It is designed for high-speed performance on standard and specialized hardware, making it a very efficient tool.

Fri, 17 Apr 2026 14:34:05 +0200

Snort is an open-source intrusion detection system (IDS) and intrusion prevention system (IPS) that can also function as a packet logger/sniffer, similar to Suricata.
It inspects network traffic to identify and log all activity, providing a comprehensive view and detailed logs of application layer transactions.
Snort requires rule sets to define inspection parameters and identify specific items of interest.
It is designed to operate efficiently on both general-purpose and custom hardware.

Snort typically operates in the following modes:
- Inline IDS/IPS.
- Passive IDS.
- Network-based IDS.
- Host-based IDS (however, Snort is not ideally a host-based IDS. We would recommend opting for more specialized tools for this.)