Now we're going to talk about the installation and configuration of
Zeek with the default configurations and scripts so that we can get
our network monitoring nodes up and running.
This clip is going to be all about what we need to get this done.
Let's start out the conversation by talking about
Zeek's dependencies and prerequisites, shall we?
Zeek is a tool that's only compatible with UNIX operating systems,
so unfortunately we can't install it directly on a Windows machine.
It can be installed in Linux platforms such as Red Hat or Debian,
as well as on Mac OS X since that's also UNIX-based.
If you're installing on a Mac,
you'll need either Xcode or command line tools installed first
so that you can compile the source code.
You can either install Zeek using prebuilt release packages found in the Zeek
downloads page or by installing directly from source code.
We'll use the source packages during our installation process.
Prior to installing Zeek,
you'll need to ensure that your packages are all updated
and you have the correct dependencies.
For version 3.0 .0,
if we're installing in a Linux build from the prebuilt package,
these are the required libraries and tools that we must have installed.
Zeek will look for these during its installation process
and likely fail if they're not there.
These help us with not only the capture and analysis of our network traffic,
but also the management so that we can have and utilize ZeekControl.
There's also plenty of optional libraries and tools that you can
install that Zeek can make use of if desired,
one of them being the GeoIP library and database,
which helps us identify where our traffic is coming and going.
One thing I wanted to mention before we get into the installation lab
is that Zeek also comes built into Security Onion,
which is awesome because it makes the setup and configuration so easy.
Security Onion is a Linux image that you can download and install that gives you
some powerful network monitoring solutions out of the box.
It comes with Zeek, along with a Snort engine,
Network Miner, and the Elasticsearch suite as a SIM.
It's an intrusion detection system almost right out of the box.
If you're trying to explore the information security space,
Security Onion could be a good,
free option for you to begin exploring the many different security tools.