Network detection and response (Zeek, Suricata)
An endpoint agent only sees the machines it is installed on. Printers, cameras, medical devices, factory controllers and unmanaged laptops never run one, yet they still talk on the network. Network detection watches that traffic from a mirror port or tap and records who talked to whom, what protocol they used and whether the traffic matched a known attack.
What we do
- Sensor placement on taps and mirror ports
- Rule selection and tuning
- Structured network logs for investigations
- Visibility into unmanaged and IoT devices
- East-west traffic hunting
- SIEM integration and retention
- Alert triage runbooks
We work with Zeek, which turns traffic into structured logs for connections, DNS, HTTP, TLS certificates and files, and with Suricata, which matches traffic against signature rules and can also write protocol logs. Security Onion bundles both with a search interface for teams that want a ready-made sensor platform. Our team designs sensor placement, tunes rules so alerts stay few and useful, and sends the output to the customer's SIEM.
This group links to our Cybersecurity practice. Network sensors cannot read encrypted content, so we plan them to work alongside endpoint and identity logs rather than replace them. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Zeek
- Suricata
- Security Onion
- Corelight
- Darktrace
Platforms and practices
- Zeek connection, DNS and TLS logs
- Suricata signature and protocol logging
- Security Onion sensor platform
- SPAN port and network tap design
- Encrypted DNS and TLS fingerprinting
- Detection tuning and false-positive review
- Forwarding sensor logs to the SIEM
- Threat hunting on east-west traffic
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Network detection and response (Zeek, Suricata) for clients
Where this matters most
Frequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageCan network detection see inside encrypted traffic?
Not the content. Zeek and Suricata still record who connected to whom, when, how much data moved, the TLS server name and certificate details, and they can fingerprint the way a client negotiates TLS. That metadata is often enough to spot beaconing or an unusual destination. Reading the content needs decryption at a proxy or on the endpoint, which has privacy and certificate trade-offs we agree with you first.
Where does the sensor connect, and does it slow the network?
The sensor receives a copy of traffic from a switch mirror (SPAN) port or a network tap, so it sits beside the traffic path, not in it. A sensor that fails or falls behind does not interrupt your users. It does need enough capacity for the mirrored volume, and the mirror must be placed where the traffic you care about actually passes, such as the firewall uplink and key server segments.
Will it bury us in alerts?
A signature set switched on without tuning will, which is why tuning is part of the work. We disable rules that do not apply to your systems, suppress known-good noise, and send the few alerts that need a person to your SIEM with the Zeek logs attached for context. We also review the alert list after the first weeks and then on a schedule.
Does this replace endpoint protection?
No. Network sensors and endpoint agents see different things and cover each other's gaps. The network view is valuable for printers, cameras, medical or factory devices and unmanaged laptops that cannot run an agent. Endpoint tools see processes and files, and can see activity inside encrypted sessions.