# Building Zeek Analytics For Hunting

> Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-building-zeek-analytics-for-hunting`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/building-zeek-analytics-for-hunting
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-building-zeek-analytics-for-hunting
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Building Zeek Analytics for Hunting

## When to Use

- You have Zeek logs (conn.log, dns.log, http.log, ssl.log, files.log) and want to build hunting
  analytics: long-lived connections, rare JA3 fingerprints, suspicious file downloads, and
  beaconing.
- You want repeatable detections expressed as Zeek scripts or log-analysis queries.

**Do not use** Zeek to actively probe hosts — it is passive analysis of captured/sensor traffic.

## Prerequisites

- Zeek logs in TSV or JSON (or a running Zeek sensor). The script analyzes exported logs.

## Workflow

### Step 1: Analyze a Zeek log for anomalies

```bash
python scripts/analyst.py analyze conn.log --kind conn
```

For `conn`, surfaces long-duration and high-byte connections; for `ssl`, counts JA3 rarity; for
`http`, flags executable/script downloads and rare user-agents; for `dns`, flags long/high-entropy
queries.

### Step 2: Express the logic as a Zeek script (optional)

Translate a confirmed pattern into a Zeek script using the appropriate event
(`connection_state_remove`, `ssl_established`, `http_reply`).

### Step 3: Confirm

Corroborate anomalies with destination reputation and other logs (pivot by `uid`).

### Step 4: Operationalize

Stage the Zeek script or scheduled log query as a durable detection.

## Validation

- The analyzer parses both TSV (`#fields`) and JSON Zeek logs.
- Surfaced anomalies match the chosen log kind's fields.
- JA3 rarity and long-connection logic are computed correctly.

## Pitfalls

- TSV header (`#fields`) parsing — column order varies by deployment.
- Backups/updates producing benign long/large connections.
- JA3 collisions across legitimate clients.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the analyzer.
- Zeek docs and log-format references (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-building-zeek-analytics-for-hunting
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.