Skip to content

Zui Hands-on Labs

Choose the route that fits your available time and computing resources. Use the Interactive Lab for a short, guided Zui investigation in this page, or the Full Lab to import and analyse the original PCAP in an isolated VM.

Hands-on proof of concept

Query it. Correlate it. Support it.

Explore structured network records, connect Zeek and Suricata evidence, isolate one suspicious flow, and preserve enough information for another analyst to reproduce your conclusion.

⏱ 2–3 hours core ◆ Guided beginner ✓ Evidence required
Start building
Self-hosted · Several hours

Zui Full Lab

Installation required

How this differs from the guided walkthrough

The guided journeys preserve the original screenshots and demonstrated investigation. This lab asks you to validate the source evidence, record exact queries, produce an extracted flow, and write a result that another analyst can reproduce.

Use an isolated, authorised environment

Treat the supplied capture and anything derived from it as hostile evidence. Use a disposable VM, disable shared folders and unnecessary networking, take a clean snapshot, and never execute an observed or extracted file.

Before you begin

You need: one disposable Ubuntu analysis VM, administrator access, approximately 8 GB of RAM and 40 GB of free disk space, Zui, and an authorised copy of the 3 June 2021 training archive used by the walkthrough. Wireshark is needed only for the optional packet-validation extension.

How to use this lab

Complete one session at a time. Stop at a milestone if the expected result is missing. Fix the import or correlation boundary before investigating files or extracting packets.

Recommended first

Beginner Core Lab

Import one documented PCAP, identify one Suricata alert, pivot by Community ID, connect the related Zeek records, and write a bounded conclusion.

Expected time: 2–3 hours across three sessions.

Optional extension

Complete Analysis Lab

After the core milestones pass, investigate observed files, perform an approved hash lookup, and extract the selected flow for packet-level validation.

Expected time: one or more additional sessions.

  1. Session 1Prepare and snapshot
  2. Session 2Import and orient
  3. Session 3Correlate and report

Objective

You are investigating a suspicious TLS flow in a malware-traffic training capture. Determine which Suricata alert describes the activity, which Zeek records belong to the same flow, and whether the available network evidence is sufficient to escalate. Do not claim endpoint execution or compromise unless separate evidence supports it.

Complete the Beginner Core Lab before attempting the optional file, reputation, or packet-extraction extensions.

01

Activity 1: Build and baseline the environment

Create the build record

Record these values before importing evidence:

Item Value to record
Validation Date, analyst, and purpose
Zui Exact version, package filename, source URL, and SHA-256
Analysis VM OS release, architecture, memory, storage, and isolation mode
Brimcap Version reported by the installed package, where available
Source archive URL, retrieval date, filename, size, and SHA-256
Source PCAP Filename, size, and SHA-256 after extraction
Recovery point Clean snapshot name and disabled VM integrations

The demonstrated dataset is the 3 June 2021 sample from Malware-Traffic-Analysis.net. Record the source page and the exact files you retrieve. The archive password follows the source site's documented infectedYYYYMMDD pattern. Do not extract the archive outside the isolated VM or redistribute its contents.

Prepare and validate Zui

  1. Create or select a disposable Ubuntu analysis VM.
  2. Place it on an isolated virtual network.
  3. Disable shared folders, clipboard integration, drag-and-drop, and automatic removable-media attachment.
  4. Follow the Zui installation procedure.
  5. Confirm that Zui starts and can open a blank query session.
  6. Transfer the archive into the VM, then calculate its hash before extraction:
sha256sum <archive-filename>
  1. Extract the archive inside the VM and hash the source PCAP:
ls -lh <source-capture.pcap>
sha256sum <source-capture.pcap>
  1. Record any filename, hash, package, or interface difference from the walkthrough.
  2. Create a clean snapshot named zui-clean-baseline before importing the capture.
Milestone 1Isolated workspace readyZui opens, the archive and source PCAP are identified and hashed, VM integrations are disabled, and the clean snapshot can be restored.

Expected result Zui opens successfully, the build record identifies each external artifact, the analysis VM is isolated, and the clean snapshot can be restored.

02

Activity 2: Import and investigate the capture

Import and orient

Follow these checkpoints in order:

  1. The source is unchangedRecalculate the PCAP hash and compare it with the Activity 1 record.
  2. The import completesUse Import Data, select the PCAP, and wait for processing to finish without an unresolved error.
  3. The pool opensOpen Query Pool and confirm the source appears after from.
  4. The dataset is orientedRecord the pool name, import times, visible time range, total rows, number of shapes, and processing warnings.
  5. The record families are recognisedIdentify a Zeek conn, dns, and ssl record and one Suricata alert.

Use the record labels—not colour alone—to classify results:

Record cue Meaning
_path: conn Zeek connection metadata
_path: dns Zeek DNS activity
_path: ssl Zeek TLS/SSL metadata
event_type: alert Suricata alert event

Narrow the evidence

  1. Right-click the alert value beside event_type and select Filter == value. Zui should generate a condition equivalent to:

    event_type == "alert"

  2. Select an alert associated with the suspicious TLS activity. Record its timestamp, signature, source, destination, ports, and Community ID.

  3. Right-click the Community ID and select Filter == value. Remove the earlier event_type condition so records from other tools can return. The remaining condition should follow this pattern:

    community_id == "<selected-community-id>"

  4. Run the query. Confirm that the result contains the selected Suricata alert and compatible Zeek records with matching flow endpoints.

  5. Preserve every query exactly as run. Record unsuccessful queries when they explain a field substitution or change in approach.
Milestone 2Cross-tool pivot workingThe source PCAP is validated, its pool opens, record families are identifiable, and one Community ID returns related Suricata and Zeek evidence.

Expected result The imported dataset contains identifiable Zeek and Suricata records, one relevant alert is documented, and an exact community-ID query returns related records across tools.

03

Activity 3: Correlate, preserve, and report

Correlate the flow

  1. Open Detail and record the fields that describe the selected connection.
  2. Open Correlations and identify related conn, ssl, and alert tiles.
  3. Record the originator, responder, ports, duration, bytes, UID, and community ID.
  4. Explain which records are connected by Zeek UID and which use community ID.
  5. Compare endpoints and direction before accepting a suggested correlation. Similar timestamps alone do not establish that records describe one flow.

Use this model when explaining the evidence:

Zeek conn ---- UID ---- Zeek ssl or file
    |
Community ID
    |
Suricata alert

Before continuing, answer:

  • Which identifier connects records produced by Zeek?
  • Which identifier supports the cross-tool pivot?
  • What evidence shows that the source, destination and direction are compatible?
  • Does the network evidence prove successful endpoint execution?
Optional: investigate an observed file and reputation context

Identify the observed file

  1. Run filename != null.
  2. Select the file relevant to the correlated activity.
  3. Record its timestamp, filename, MIME type, connection identifier, hash algorithm, and hash value.
  4. If policy permits an external reputation lookup, record the provider, query time, and result. Do not upload the file.
  5. Treat reputation as context rather than proof of execution.
Optional: extract and validate the selected packet flow

Extract and validate the flow

  1. Return to the relevant connection and select Download Packets.
  2. Save the extracted capture inside the isolated VM.
  3. Record its filename, size, and SHA-256.
  4. Open it in Wireshark and confirm that its endpoints and time range match the Zui record.
  5. Do not export or execute observed payloads merely to complete the exercise.

Write the conclusion

Include the investigation question, source PCAP hash, exact queries, relevant timestamps and endpoints, alert signature, UID, community ID, observed filename and hash or extracted-flow hash when an optional extension was completed, supported conclusion, and limitations.

Use this structure for your first analyst note:

Investigation question:
Source PCAP and SHA-256:
Selected alert and timestamp:
Source and destination:
Community ID:
Related Zeek records and UID:
Optional file or extracted-flow evidence:
What the evidence supports:
What the evidence does not prove:
Confidence, limitations, and next action:

For peer validation, ask another analyst to repeat the saved queries. If you are working alone, restore zui-clean-baseline, reimport the same source PCAP, and repeat the Community ID pivot. Record any version-dependent differences.

Milestone 3One finding supportedYou traced one alert to compatible Zeek records, explained the identifiers used, and wrote a conclusion that distinguishes network observations from unproven endpoint activity.

Expected result Another analyst can repeat the queries, trace the alert to related Zeek records, explain the UID and Community ID pivots, and distinguish observed network facts from assumptions about endpoint execution.

Full Lab evidence checklist

This checklist applies to the VM-based Full Lab. If you completed the Interactive Lab, retain its downloaded evidence summary instead. Record optional file, reputation, and packet-extraction evidence separately.

0 of 8 recorded Mark each item after saving the evidence.
Optional extension evidence

If used, retain the observed filename, MIME type and hash; approved reputation context; or extracted-flow filename, size and SHA-256 alongside the core record. Optional evidence does not replace a missing core milestone.

Troubleshooting

Symptom First check
Import appears stuck Confirm the VM has free disk space and wait for processing to finish before opening Query Pool. Preserve any import error before retrying.
The pool contains no Suricata alerts Confirm you imported the documented PCAP and that bundled processing completed. Record the Zui and Brimcap versions before substituting another dataset.
A field name differs from the walkthrough Open Detail, identify the equivalent field in your record, and preserve the exact query and substitution.
The alert-only filter does not run Remove the generated condition, right-click the actual event_type value again, and compare the resulting syntax with your saved query.
Community ID returns only one record type Remove the event_type condition, verify the complete Community ID, and compare endpoints. Not every dataset or processing version produces every record family.
Download Packets is unavailable Select a connection backed by the imported PCAP and confirm processing completed. Treat extraction as optional if the index is unavailable.
The extracted capture differs from the selected flow Compare its source hash, endpoints, ports and time range before relying on it. Do not modify the source PCAP to force a match.

Clean up

  1. Close Zui, Wireshark, terminals, and text editors.
  2. Preserve authorised notes, queries, hashes, and required packet evidence in the approved case or lab location.
  3. Delete temporary extracted content and packet-flow copies from transfer locations.
  4. Revert the disposable VM to zui-clean-baseline, or securely dispose of it according to the lab procedure.
  5. Confirm that shared folders and clipboard integration remain disabled.
  6. Record who completed cleanup and when.

Where to go next

Review the walkthroughReturn to the original screenshots and investigation sequence. Build a Wireshark labValidate packet-level evidence and exported objects. Build a Zeek labGenerate and inspect structured records directly.
PreviousCorrelate and extract NextUnderstanding SIRP