LoveKebab

Zeek is actually super powerful.

It’s more of a Network Security Monitoring tool (NSM) than a Wireshark equivalent

It’s primary use case is to have a server(s) ingesting all traffic in a network and forwarding the traffic metadata to something like an Elastic Stack.

What makes it so powerful though, is that it actually has its own scripting language that allows you create automations based off what type of traffic is observed and these can be super intricate

Yeah exactly - providing proof publicly could in fact burn the sources/methods used to get that proof.

Yes depending on the use case.

Each of the cloud providers have various things they do better than others depending on what you’re trying to do.