Install Zui¶
Install Zui on an isolated analysis VM and confirm that the application can open a query session before importing evidence.
Before installation¶
Record the validation date, operating-system release and architecture, Zui version, installer filename, download source, and SHA-256 checksum. Use a disposable VM for malware-traffic analysis and take a clean snapshot first.
Download the installer from the Zui download page that is appropriate for your Linux distribution.
Package names and interfaces change
The command below reproduces the package used in the original walkthrough. Substitute the filename you validated rather than assuming that version is still current.
Install the package¶
On the Ubuntu analysis VM, change to the directory containing the downloaded package and run:
Start the application from the desktop menu or a terminal:
Zui Desktop includes Brimcap, a command-line utility that converts packet captures into searchable Zed data. In the demonstrated workflow, Brimcap uses Zeek and Suricata analysis when processing an imported PCAP.
Installation checkpoint
Installation is complete when Zui starts, a query session can be opened, and the application version, package source, checksum, and VM snapshot are recorded.
If Zui does not start¶
- Confirm that the package architecture matches the VM.
- Review dependency errors produced by
dpkg. - Confirm that the desktop session can display graphical applications.
- Return to the clean snapshot before trying a materially different package.
- Record any package or interface difference from the proof of concept.