Enrich your advanced hunting experience using network layer signals from Zeek

Hi John_McCash, thank you for your feedback!

To clarify - "Kerberos_TGS_REQ" signature is part of our older sensor and not Zeek.

This signature (and almost every signature under "NetworkSignautreInspected") wasn’t designed for advanced parsing and fields extraction, only for activity tracking or free text searching for cases where hunter would like to know which device accessed specific resource (i.e searching computer FQDN inside SamplePacketContent). The reason it’s not meant for parsing is that the capabilities were limited before, and this is why we named the fields inside AdditionalFields column with "Sample" prefix.

Now that we integrated Zeek into MDE, and as mentioned on the blog, exposing Zeek Kerberos events is on our roadmap (we don’t have an exact ETA yet but its work in progress as you can see). The Zeek events are much more informative and can provide a great leverage point for hunting and custom detections.

I hope this clarifies,

Meitar