Investigations during a threat hunt or incident response are much like getting to know someone. In this article, you’ll find a series of questions you can ask to learn more about a new person non-biological entity. With help from the Threat Hunting Toolkit, I’ll explain where you can find information in the logs, and provide a command to print it.

You can think of the Threat Hunting Toolkit (THT) as a command line environment containing a curated selection of data-processing utilities you can take with you anywhere, much like a craftsman’s toolkit. While THT is designed with processing Zeek network logs in mind (both TSV and JSON), we’ve also used it successfully with other delimited logs, such as comma or whitespace separated.

Without further ado, let’s make some small talk.

What’s Your Name?

A name can tell a lot about a person. The same goes for a system’s host name. The host name shows up in different network service communication and can be pulled from a number of Zeek logs.

In the dns log, typically the query field will contain a domain and the answers field will contain one or more IP addresses, though it can also contain additional domains. (Note: For PTR requests, you can parse an IP address from the query field and a domain from the answers field instead.)

In the ssl log, the server_name field will contain a domain that corresponds with the IP address in the id.resp_h field. In the http log, the host field will contain a domain instead.

There are additional sources for systems on the local network as well. These services aren’t usually seen in internet-bound traffic and thus, only apply to the local network.