Blog Post

Microsoft Defender for Endpoint Blog
13 MIN READ

Enrich your advanced hunting experience using network layer signals from Zeek

Christos_Ventouris's avatar
Christos_Ventouris
Icon for Microsoft rankMicrosoft
Apr 17, 2023
UPDATE : July 9, 2023 The article has been updated to include new signatures added for SSL, DNS and NTLM protocols.   UPDATE : May 22, 2023 On July 18, 2023, Microsoft will be deprecating a s...
Updated Jul 17, 2023
Version 6.0
Philost's avatar
Philost
Brass Contributor
Apr 22, 2023

It’s really good to see this surface in Advanced Hunting.

 

 Appreciating that Zeek cannot get insight into encrypted traffic, will you be surfacing the insights that are available?

https://docs.zeek.org/en/master/logs/ssl.html

Great work and keep it up!