The Examination module of Zeek has two features that both equally Focus on signature detection and anomaly Examination. The very first of these Assessment resources will be the Zeek occasion motor. This tracks for triggering functions, like a new TCP connection or an HTTP ask for.Just about every occasion is logged, so this A part of the procedure