RITA beacon detection

rita analyze -d <db>

Analyze Zeek logs with RITA to detect beaconing (C2) by connection periodicity, not signatures.

Run it when you have Zeek logs from the segment and want to detect C2 without relying on IOCs: RITA computes statistical metrics on connections — periodicity (C2 beaconing contacts at regular intervals), duration, size, and byte similarity — and generates a ranking of hosts and destinations with beacon scores. It's behavioral detection: C2 that no IOC knows about is caught by the rhythm of its connections. In hunting, rita analyze on the week's logs is the sweep that pulls out beacons that signatures miss.

Don't use it without quality Zeek logs: RITA feeds on conn.log — without the sensor seeing the segment or with short rotation, the analysis is partial. Legitimate beaconing (updates, telemetry, application heartbeats) generates false positives: high scores are reviewed with context (destination, endpoint process) before declaring C2. And watch out: RITA detects periodicity, not intent — C2 with jitter (interval variation) or using protocols without detailed conn.log scores lower. For continuous analysis, rita import + analyze is scheduled as a task; for point-in-time IR, analyze the incident window.