Zeek (bro) scripts

zeek -r cap.pcap local

Process a pcap with Zeek and the local policy, generating structured logs (conn, dns, http, ssl) of the captured traffic.

Run it when you want to turn a capture into structured logs: zeek -r processes the pcap offline and generates per-protocol logs — conn.log (connections with their state and volume), dns.log, http.log, ssl.log, among others. It's the same machinery that runs on the network sensor, applied to a pcap: the subsequent analysis (hunting for beaconing, correlating, building timelines) is done on logs, not packets. In IR, it's the step that converts raw evidence into queryable data — the same question that with tshark requires field filters, with Zeek is answered with queries on the logs.

Don't use it as a replacement for packet analysis: Zeek parses the protocols it knows — encrypted traffic (TLS content) or protocols without a parser stay in conn.log without detail. The local policy (local.zeek) loads the default scripts: without it, the processing is basic. And watch out for performance: processing large pcaps with Zeek is slower than tshark (the per-protocol analysis is deep); for quick triage of a small pcap, tshark is more direct, and for continuous flow there's the live sensor. Logs generated by zeek -r do not include traffic after the pcap — it's a bounded offline analysis.