| Cybesecurity | Suricata | Zeek | Blue Teaming | SOC|

If Suricata is the alarm that goes off when something looks wrong, Zeek is the security camera that was rolling the entire time, whether anything looked wrong or not. I did not really understand why that distinction mattered until I had an actual alert in front of me and needed to answer a question Suricata simply could not answer on its own.

What actually happened on the network around that alert.

An alarm tells you something, not everything

Suricata’s whole job is detection. It compares traffic against rules and signatures, and when something matches, it writes an entry to a log and moves on. That entry is genuinely useful. It tells you a rule fired, which IP addresses were involved, and roughly when it happened.

What it does not tell you is the story around that moment. Was that IP address doing anything else around the same time. Did it resolve a suspicious domain first. Did a file get transferred. Suricata is not…