Welcome back.
In the previous module,
we started the discussion about using Zeek in the enterprise and talked about
some of the installation options that we have with Zeek,
as well as how the engine works.
This module's going to be all about the components of the tool.
We'll learn a lot about how Zeek works and describe the
various methods that are used to get data in,
analyze it, and get it out.
We're going to discuss the various components of Zeek in detail,
so we get a good understanding of the way everything works together
inside of Zeek to allow it to function effectively.
We'll start out by detailing the various frameworks within Zeek
where we'll cover the specific things that we can do with the
tool and what it uses to do them.
Then,
we're going to talk about the subcomponents that help
make up what Zeek is and what it does.
This will give us an understanding of the things that we need
to interact with or that interact with other things to utilize
certain features or functions.
After that,
we'll talk about some of the plugins that are available to us to give
Zeek some additional functionality and expandability.
Remember,
Zeek is a fantastic monitoring solution that allows us to see
activity in our network and tell us what's going on.
We can use this for security monitoring or network functionality monitoring,
and the various frameworks, components,
and plugins that we have available are great tools
to help us make the most of it.
These allow us to push the limits of Zeek so that we can
get what we want with this one tool.
It can be frustrating having to upgrade or patch
software just to add features to it,
and Zeek does a great job making some of this more modular so you
don't really have to update it to add features,
change configurations, update scripts, and gain additional context.
Frameworks are what allow us to do specific things with the Zeek system,
and there are many different ones that are purposed for many different things.
We'll cover them all in detail in this module.
The subcomponents are what make up the Zeek ecosystem and
allow it to have specific functionality,
typically intended to do something in an efficient manner.
The plugins are great ways to add functionality to the Zeek system
without needing to modify the code that it's running.
This is through APIs that extend the system's uses to
give us additional possibilities.
Let's check all of this out and get some good information
about them as we move through the module.