A network security monitoring analyst wants to understand what percentage of network sessions are encrypted on the enterprise network. Which Zeek log provides the most direct answer?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need conn.log, filtered by the service field for 'ssl', then compare that to the total connection count. That's the most direct encrypted-session percentage because conn.log is the session baseline.
Full Explanation
The correct choice is conn.log, filtering by the service field for 'ssl' and comparing that count to the total connection count. conn.log provides the overall session baseline, and the service field is the direct Zeek indicator used to identify encrypted sessions tagged as ssl, so dividing the ssl service count by total connections yields the most direct encryption percentage. This approach does depend on Zeek tagging encrypted traffic as ssl and can miss encrypted sessions not tagged that way, but it remains the most direct single-log method for enterprise session encryption percentage. The dns.log approach, counting DNS-over-TLS queries and comparing them to the total number of DNS lookups, is wrong because it only measures encryption within DNS traffic, not all network sessions. The ssl.log approach, treating its entry count alone as the percentage, is wrong because ssl.log records only the SSL/TLS sessions Zeek parsed; it contains no cleartext sessions, so it has no denominator and cannot yield a percentage without the total from conn.log. The http.log approach, counting HTTPS versus HTTP entries, is wrong because http.log only captures HTTP/HTTPS web traffic, not all encrypted traffic such as SMTP over TLS, IMAPS, LDAPS, and other encrypted protocols.