ZeekWeek 2022 - Zeek for Windows: The Journey to Run on All Endpoints - Elad Solomon
Channel: Zeek
Date: 02/11/2022

By Elad Solomon, Senior Software Engineer, Microsoft

At Microsoft, one of the pillars of Microsoft Defender for Endpoint (MDE) is its Network Detection & Response (NDR) capabilities which allows device discovery, detection of network-based attacks and response to ongoing cyber-attacks. The NDR agent runs on every onboarded endpoint in the customer’s network and collects information based on incoming and outgoing traffic. This data is processed in the cloud and produces insights that are displayed to the customer (such as Device Inventory, Vulnerability Assessments, alerts, etc.). 

One of the challenges we face is the time it takes to deliver new content to our customers endpoints. Meanwhile, new cyber-attacks are impacting customers at a growing rate. To overcome this gap, we understood that we need a fast way to deploy new detection logic to our agents, thriving to shorten the response time from months to hours. After exploring multiple alternatives, we’ve found Zeek – a mature open-source network detection platform with scripting abilities and numerous built-in dissectors that are already production-ready. Thus, we concluded that for the long-term Zeek is a great fit for NDR    .

There was only one problem – Zeek isn’t built for Windows!

In order to fully take advantage of Microsoft Defender for Endpoint’s large scale and network visibility, we realized that running Zeek on Windows endpoints is crucial. We needed to take Zeek to uncharted territory and run it in an unprecedented domain – Windows endpoints.

This, naturally, made our goal clear – to create a Windows adaptation for Zeek (AKA porting).

This adaptation, as we planned from the beginning, will be our contribution back to this amazing community.

In this talk, we are going to present the changes we introduced to Zeek in order to adapt it for running on Windows endpoints, the many challenges we faced and insights we learned along the way. To name a few – 

    Native compilation of a UNIX-based project with MSVC
    Zeek performance impact on endpoints
    Zeek security implications on Windows

Moreover, we are going to share how integrating with Zeek has transformed our NDR agent and evolved it to become a platform for researchers, empowering them to develop new content independently. Additionally, we’ll talk about how Zeek is bringing us new opportunities for collaboration between products inside Microsoft and out here in the Zeek community.

Speaker Bio: Elad is a Senior Software Engineer with 7+ Years of experience of engineering in the cyber-security field with a specialization in Windows Internals, autonomous agents, and scripting engines. Before joining Microsoft, Elad served as a captain in Unit 8200, the IDF’s cyber and intelligence units, where he was a software engineer and R&D team leader and developed several award-winning projects for one of the unit’s main intelligence operations. At Microsoft, he develops the agent for the Microsoft Defender for Endpoint (MDE) Network Detection and Response (NDR) component. He leads a small feature team consisting of his fellow team-members, to bring forth the vision to integrate Zeek into NDR and create the next generation architecture for NDR.