Welcome back to the course.
In the previous module,
we saw Zeek in action and looked at the configuration and functionality of Zeek.
In this module,
we're going to dig a little bit further into those concepts and
learn about the deployments and installations,
as well as how Zeek works.
We'll dig into this so we can understand its core functionality to be able to
fully realize how special Zeek is and what we can do with it.
We'll start off this module by talking about a few
different deployment types for Zeek.
We'll then talk about the Zeek engine, as I call it,
which is how Zeek works internally.
We'll also detail one of the ways to control Zeek called ZeekControl.
We're going to discuss the installation and configuration of Zeek too,
and have a demo showing these steps in our CentOS box.
Then, we'll review what we learned and get ready for the next module.
So we're talking about two different deployment models for Zeek first.
We have a standalone deployment and a cluster deployment.
In the standalone deployment,
the system does the monitoring itself based on the configurations that
you provide and is controlled via the same machine.
This one is by itself, no help at all, so to speak.
The other way that we can deploy Zeek is in a cluster configuration.
A cluster means that there is a set of systems that are working together,
or in a coordinated fashion at least, to analyze the network traffic.
You can manage the deployment using something called ZeekControl,
which we'll cover later on in the module.
One benefit for clustered configuration is scalability.
Since you're essentially managing your cluster from one node and only
deploying sensors wherever you need to analyze the traffic,
it's easier just to spin one up and attach it to the manager.
If you are needing to deploy hundreds of these,
can you imagine managing each one individually?
I think another benefit for this deployment method is the management.
Sure, the scalability mentioned previously is a huge plus,
but as I've said, can you imagine managing 100 nodes in standalone mode?
Centrally managing the configurations and being able to
control those managed nodes is very helpful.
The deployment that I'm using is just a simple standalone one,
but if you want to learn how to set up a cluster,
the Zeek documentation is awesome.
Okay,
so nobody likes going in and having to manually start
and stop nodes when there's an issue,
pull stats from multiple boxes individually,
and manage the cluster in general from anything but a central manager.
This is sort of where ZeekControl, formerly known as BroControl,
comes into play.
This provides us an interactive shell to be able to
operate and manage the Zeek installations.
It works for standalone and cluster deployments and can be used
to install the system and scripts as well.
To get ZeekControl,
you can navigate to the path/bin directory and enter it by typing in sudo.
/zeekctl.
This will take you inside of the shell where you have
several options to choose from for management.
Here,
we can perform all of the tasks listed without having
to go track down our cron jobs,
see the current packet capture counters for the interfaces,
and see the top system processes.
We are also able to clean up the installation and start-stop the nodes.
It gives us a single pane of glass for the cluster deployment too.