{ "cells": [ { "cell_type": "markdown", "metadata": {}, "source": [ "
\n", "\n", "# Zeek Network Data to Plotting\n", "Yes, this is provincial, but going from a Zeek log to a visual data plot in a few lines of code might be really handy sometimes. So without further ado here's a very small bit of code :)\n", "\n", "\n", "\n", "### Software\n", "- Zeek Analysis Tools (ZAT): https://github.com/SuperCowPowers/zat\n", "- Pandas: https://github.com/pandas-dev/pandas\n", "- Matplotlib: https://matplotlib.org" ] }, { "cell_type": "markdown", "metadata": {}, "source": [ "## Quickly go from Zeek log to Pandas DataFrame" ] }, { "cell_type": "code", "execution_count": 10, "metadata": {}, "outputs": [ { "name": "stdout", "output_type": "stream", "text": [ "Successfully monitoring ../data/http.log...\n" ] }, { "data": { "text/html": [ "\n", " | filename | \n", "host | \n", "id.orig_h | \n", "id.orig_p | \n", "id.resp_h | \n", "id.resp_p | \n", "info_code | \n", "info_msg | \n", "method | \n", "orig_fuids | \n", "... | \n", "resp_mime_types | \n", "response_body_len | \n", "status_code | \n", "status_msg | \n", "tags | \n", "trans_depth | \n", "uid | \n", "uri | \n", "user_agent | \n", "username | \n", "
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
ts | \n", "\n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " | \n", " |
2013-09-15 17:44:27.668082 | \n", "- | \n", "guyspy.com | \n", "192.168.33.10 | \n", "1031 | \n", "54.245.228.191 | \n", "80 | \n", "- | \n", "- | \n", "GET | \n", "- | \n", "... | \n", "text/html | \n", "184 | \n", "301 | \n", "Moved Permanently | \n", "(empty) | \n", "1 | \n", "CyIaMO7IheOh38Zsi | \n", "/ | \n", "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT ... | \n", "- | \n", "
2013-09-15 17:44:27.731702 | \n", "- | \n", "www.guyspy.com | \n", "192.168.33.10 | \n", "1032 | \n", "54.245.228.191 | \n", "80 | \n", "- | \n", "- | \n", "GET | \n", "- | \n", "... | \n", "text/html | \n", "100631 | \n", "200 | \n", "OK | \n", "(empty) | \n", "1 | \n", "CoyZrY2g74UvMMgp4a | \n", "/ | \n", "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT ... | \n", "- | \n", "
2013-09-15 17:44:28.092922 | \n", "- | \n", "www.guyspy.com | \n", "192.168.33.10 | \n", "1032 | \n", "54.245.228.191 | \n", "80 | \n", "- | \n", "- | \n", "GET | \n", "- | \n", "... | \n", "text/html | \n", "55817 | \n", "404 | \n", "Not Found | \n", "(empty) | \n", "2 | \n", "CoyZrY2g74UvMMgp4a | \n", "/wp-content/plugins/slider-pro/css/advanced-sl... | \n", "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT ... | \n", "- | \n", "
2013-09-15 17:44:28.150301 | \n", "- | \n", "www.guyspy.com | \n", "192.168.33.10 | \n", "1040 | \n", "54.245.228.191 | \n", "80 | \n", "- | \n", "- | \n", "GET | \n", "- | \n", "... | \n", "text/plain | \n", "887 | \n", "200 | \n", "OK | \n", "(empty) | \n", "1 | \n", "CiCKTz4e0fkYYazBS3 | \n", "/wp-content/plugins/contact-form-7/includes/cs... | \n", "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT ... | \n", "- | \n", "
2013-09-15 17:44:28.150602 | \n", "- | \n", "www.guyspy.com | \n", "192.168.33.10 | \n", "1041 | \n", "54.245.228.191 | \n", "80 | \n", "- | \n", "- | \n", "GET | \n", "- | \n", "... | \n", "text/plain | \n", "10068 | \n", "200 | \n", "OK | \n", "(empty) | \n", "1 | \n", "C1YBkC1uuO9bzndRvh | \n", "/wp-content/plugins/slider-pro/css/slider/adva... | \n", "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT ... | \n", "- | \n", "
5 rows × 26 columns
\n", "