Tutorial Attack case

The folder 'Attack case' contains logs generated by Zeek-Agent from an attack. You can upload the data to elasticsearch using 'es_load.py'. The compromised file is 'syslog' which you can search on and trace the attack, you might observe a note from the attacker when clicking on one of the process nodes. The note will be present in the 'message.txt' file. The freeze exploration command will prove to be helpful to see node details without exploring them.