+
+
+ Zeek Network Traffic by Type
+
+
+ index=zeek | stats count by _time, tag::eventtype | timechart span=1h count by tag::eventtype
+ -24h@h
+ now
+
+
+
+
+
+
+
+
+
+ Windows Events by Host
+
+
+ | tstats count where index=wineventlog by host, _time span=1h prestats=t | timechart span=1h count by host
+ -24h@h
+ now
+
+
+
+
+
+
+
+ Sysmon Events by Host
+
+
+ | tstats count where index=sysmon by host, _time span=1h prestats=t | timechart span=1h count by host
+ -24h@h
+ now
+
+
+
+
+
+
+ osquery Events by Host
+
+
+ | tstats count where index=osquery by host, _time span=1h prestats=t | timechart span=1h count by host
+ -24h@h
+ now
+
+
+
+
+
+
+
+
+
+ Jack Crook's Hunting for Beacons Query
+
+ http://findingbad.blogspot.com/2020/05/hunting-for-beacons-part-2.html
+
+ index=zeek (dest_port=443 OR dest_port=80)
+| rename orig_bytes as bytes_out resp_bytes as bytes_in
+| stats count(bytes_out) as "beacon_count" values(bytes_in) as bytes_in by src_ip,dest_ip,bytes_out |eventstats sum(beacon_count) as total_count dc(bytes_out) as unique_count by src_ip,dest_ip
+| eval beacon_avg=('beacon_count' / 'total_count')
+| stats values(beacon_count) as beacon_count values(unique_count) as unique_count values(beacon_avg) as beacon_avg values(total_count) as total_count values(bytes_in) as bytes_in by src_ip,dest_ip,bytes_out
+| head 100
+| eval incount=mvcount(bytes_in)
+| eventstats avg(beacon_count) as overall_average
+| eval beacon_percentage=('beacon_count' / 'overall_average')
+| sort - beacon_percentage
+ -24h@h
+ now
+
+
+
+
+