## Zeek (Bro) Surveillance

**Zeek** is not a traditional IDS. It is a "Network Flight Recorder".
It doesn't just look for attacks; it logs **everything** in structured metadata.

### The Power of Zeek
Instead of a binary "Match/No Match", Zeek creates logs:
*   `conn.log`: Every single TCP/UDP connection. (Duration, Bytes, Service).
*   `http.log`: Every URL, User-Agent, Referrer.
*   `dns.log`: Every DNS query.
*   `ssl.log`: Every Certificate seen.

### Forensics Use Case
*   **Alert**: "Malware detected on PC-5."
*   **Question**: "Has PC-5 talked to this C2 server before today?"
*   **Snort**: "I don't know, there was no signature."
*   **Zeek**: "Yes. Checking `dns.log`... PC-5 queried `evil.com` 4 days ago. Checking `conn.log`... data was transferred."

### Threat Hunting
"Show me all SSL Certificates where the Issuer is 'Let's Encrypt' but the domain is a Bank." (Phishing).