Which Zeek log file records detected attacks and policy violations generated by Zeek's scripting framework and built-in detectors, separate from specific protocol logs?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because notice.log is Zeek's unified log for events generated by policy scripts, including port scans, bad SSL certificates, suspicious DNS activity, and other higher-level detections that transcend individual protocol logs. A is wrong because conn.log records all network connection metadata but does not contain detection notices.
Full explanation below image
Full Explanation
B is correct because notice.log is Zeek's unified log for events generated by policy scripts, including port scans, bad SSL certificates, suspicious DNS activity, and other higher-level detections that transcend individual protocol logs. A is wrong because conn.log records all network connection metadata but does not contain detection notices. C is wrong because 'alert.log' is not a standard Zeek log file; Suricata uses alert logs. D is wrong because weird.log records unexpected or protocol-violating behaviors that Zeek cannot fully parse, not general security detections.