{"id":67303,"date":"2026-10-26T10:06:59","date_gmt":"2026-10-26T09:06:59","guid":{"rendered":"https:\/\/www.secuinfra.com\/news\/corelight-ctf-through-zeek-logs-a-few-moments-of-panic-and-all-the-way-to-the-podium\/"},"modified":"2026-10-27T14:52:11","modified_gmt":"2026-10-27T13:52:11","slug":"corelight-ctf-through-zeek-logs-a-few-moments-of-panic-and-all-the-way-to-the-podium","status":"publish","type":"post","link":"https:\/\/www.secuinfra.com\/en\/news\/corelight-ctf-through-zeek-logs-a-few-moments-of-panic-and-all-the-way-to-the-podium\/","title":{"rendered":"Corelight CTF: Through Zeek logs, a few moments of panic, and all the way to the podium"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-flat ez-toc-counter ez-toc-white ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">[inhalt_uebersetzt]<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.secuinfra.com\/en\/news\/corelight-ctf-through-zeek-logs-a-few-moments-of-panic-and-all-the-way-to-the-podium\/#When_the_supposedly_clear-cut_answer_is_wrong\" >When the supposedly clear-cut answer is wrong<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.secuinfra.com\/en\/news\/corelight-ctf-through-zeek-logs-a-few-moments-of-panic-and-all-the-way-to-the-podium\/#An_Exciting_Journey_Through_the_Data\" >An Exciting Journey Through the Data<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.secuinfra.com\/en\/news\/corelight-ctf-through-zeek-logs-a-few-moments-of-panic-and-all-the-way-to-the-podium\/#Two_individual_entries_a_great_success_for_the_company\" >Two individual entries, a great success for the company<\/a><\/li><\/ul><\/nav><\/div>\n\n<p class=\"wp-block-paragraph\">The Corelight CTF was a really cool event that really challenged our colleagues technically. They worked their way through Zeek logs, searched for connections in the Investigator, and tried to piece together a coherent picture from individual anomalies. At times, they were pretty convinced they were on the right track. But the next answer would occasionally prove them wrong.   <\/p>\n\n<p class=\"wp-block-paragraph\">\u201cOur colleagues\u201d refers to Konrad and Aurel. They each competed individually, worked independently of one another, and did not exchange answers. So each had their own queries, their own approaches to solving them, and presumably their own personal moments of doubt as well. Nevertheless, we can all celebrate the results together: first place for Aurel and second place for Konrad. Both spots thus remain within the company.    <\/p>\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"When_the_supposedly_clear-cut_answer_is_wrong\"><\/span>When the supposedly clear-cut answer is wrong<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n<p class=\"wp-block-paragraph\">A challenge like this quickly reveals just how big the difference can be between a plausible explanation and a verifiable answer. Finding a striking connection is a start. Figuring out what happened beyond that\u2014and which systems were involved\u2014takes a little more patience.  <\/p>\n\n<p class=\"wp-block-paragraph\">Aurel got a little sidetracked here and there. The query returned a result that matched his expectations, and the answer actually seemed unambiguous. Apparently, it wasn\u2019t. So, back to the drawing board: Had he selected the right field? Was he counting connections or different hosts? Did his result even answer the question that was asked?     <\/p>\n\n<p class=\"wp-block-paragraph\">At moments like that, a brief sense of panic would set in\u2014especially when I\u2019d already spent quite a bit of time following what I thought was a good lead. In hindsight, it\u2019s easy to say that you just have to stay calm and keep searching systematically. But in the heat of the moment, my enthusiasm for that advice is sometimes a bit limited.   <\/p>\n\n<p class=\"wp-block-paragraph\">But Aurel actually enjoyed that, too. You have to be able to correct yourself and be willing to set aside even a nice explanation. After all, the logs aren&#8217;t swayed by how certain you are of your answer at the moment.  <\/p>\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"An_Exciting_Journey_Through_the_Data\"><\/span>An Exciting Journey Through the Data<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n<p class=\"wp-block-paragraph\">The tasks led to an exciting journey through the Zeek logs and the Investigator. A DNS query turned into another lead. One connection led to the next log type, and a download raised new questions. Little by little, the individual observations had to be sorted out so that a collection of suspicious events could be turned into a coherent sequence of events.   <\/p>\n\n<p class=\"wp-block-paragraph\">Time and again, the key was to look closely. A port alone is not reliable evidence of the protocol being used. An alarm name doesn&#8217;t automatically tell the whole story. And a field that looks appropriate at first glance may not be what the task is actually asking for.   <\/p>\n\n<p class=\"wp-block-paragraph\">These are things you generally know. Handling them properly even when under time pressure is a different story. That\u2019s when you quickly realize which steps you\u2019ve really mastered and where you\u2019ve been a little too generous with your own assumptions.  <\/p>\n\n<p class=\"wp-block-paragraph\">For us, that\u2019s where the great value of such events lies. You try things out, sometimes stumble over a minor detail, and have to figure out the context on your own. When it finally clicks, you retain much more than you would from a solution you simply read about. It\u2019s precisely these experiences that you can carry over into your daily work later on.   <\/p>\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Two_individual_entries_a_great_success_for_the_company\"><\/span>Two individual entries, a great success for the company<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n<p class=\"wp-block-paragraph\">In the end, we took first and second place on the scoreboard. We\u2019re obviously very happy about that. It\u2019s especially great that Konrad landed right in second place on his own merit. He really delivered a strong performance. Congratulations!    <\/p>\n\n<p class=\"wp-block-paragraph\">The fact that the top two spots were filled by our own employees makes the result even more satisfying for us. Everyone worked through the tasks on their own and arrived at their answers independently. That means there\u2019s all the more to talk about afterward: Where did you get stuck, which clue was helpful, and at what point did you overcomplicate things?  <\/p>\n\n<p class=\"wp-block-paragraph\">The results are a great way to wrap things up. But what you\u2019ve learned along the way is just as valuable\u2014if not more so. It\u2019s especially the wrong turns that stick in your mind. You end up taking a closer look at some queries afterward, and hopefully, the next time you analyze them, you\u2019ll question certain assumptions a little sooner.   <\/p>\n\n<p class=\"wp-block-paragraph\">We\u2019re glad our colleagues participated, and we\u2019d recommend the Corelight CTF to anyone interested in incident response and threat hunting who wants to put their knowledge to the test in a hands-on setting. It was challenging, a bit nerve-wracking at times, and overall, an event that was really fun. <\/p>\n\n<p class=\"wp-block-paragraph\">Many thanks to Corelight for the exciting assignments. I&#8217;d love to do it again. Those little moments of panic are apparently just part of the deal.  <\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Corelight CTF was a really cool event that really challenged us technically. We worked our way through Zeek logs, looked for connections in the Investigator, and tried to piece together a coherent picture from individual anomalies. At times, we were pretty convinced we were on the right track. But the next answer would occasionally prove us wrong.   <\/p>\n","protected":false},"author":33,"featured_media":67304,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"dpc_author_order":[33],"footnotes":""},"categories":[60],"tags":[],"class_list":["post-67303","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts\/67303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/comments?post=67303"}],"version-history":[{"count":2,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts\/67303\/revisions"}],"predecessor-version":[{"id":67336,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/posts\/67303\/revisions\/67336"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/media\/67304"}],"wp:attachment":[{"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/media?parent=67303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/categories?post=67303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.secuinfra.com\/en\/wp-json\/wp\/v2\/tags?post=67303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}