If you made it through the entire course material, congratulations.
We covered a lot of great content that you can
apply or adapt to your environment.
Let's take a look at a summary of what was covered
during your journey to this point.
I started the course by showing you how to design and deploy
a Zeek cluster based on a sensor strategy developed using
this Globomantics network diagram.
The first module ended with a demonstration of how to use the
Filebeat agent to ship Zeek logs to the Elastic Stack.
In the next module, we looked at how to leverage Zeek for continuous monitoring.
There were three specific areas or gaps we needed to address, rogue server
detection, SSL certificate auditing, and DNS auditing.
I also spoke about some of the limitations of Zeek.
I had a lot of fun teaching this module. In the last module, I
showed you how Zeek can be used for threat‑hunting data
exfiltration and network‑based reconnaissance.
We ended the module with an incident response case where we looked
at using Zeek to retrieve a malicious file and performing some
post‑mortem analysis of a compromised host.
I really hope you enjoyed this course as much as I loved creating it.
I just want to say thank you for watching my course
and improving your domain knowledge.
If you need to contact me, you can reach out to me on Twitter or LinkedIn.
Once again, thank you.
My name is Michael Edie, and this has been my course on Utilizing Zeek for
Enterprise Monitoring or for Distributed Environments.