Let's move on and start talking about how Zeek works.
Zeek takes our network traffic, runs it through an event engine,
then uses scripts to tell it what to do based on the events.
We'll cover those more in detail next,
but that's the basis of the Zeek functionality.
Traffic, event engine, then policy script interpreter.
So the event engine is what gives us the packet analysis that Zeek thrives with.
It takes those raw packets and uses several analyzers to look at the
traffic to identify any events that may be occurring.
All the event engine does is perform the analysis.
It doesn't make any decisions on what to do with the events at all.
Within Zeek,
some of the analyzers that it uses include transport layer analyzers,
application layer analyzers, as well as infrastructure ones.
Some of these have specific subsets, for example the application layer ones,
to look at the behavior of certain protocols.
Zeek is also able to track connections so that it can identify
any suspicious connection behavior with protocols that may need
things like a three-way handshake.
The policy script interpreter is what defines the actual policies
that Zeek will use to determine what to do with the events that
it receives from the event engine.
This uses scripts to identify the events and generate alerts.
With something called event handlers,
you can customize your own policies within Zeek and have the
interpreter use those on top of the default ones.
Zeek's scripting language is event-driven,
so you have to know what you're looking for.
So after the event engine sends the events to the policy script interpreter,
some sort of notification or alert is generated,
and you're off to investigating.