So as I discussed,
the Zeek framework allows us to do something specific within Zeek.
The configuration framework is the first one that I want to discuss,
and its purpose is exactly what it sounds like.
It allows us to change the configuration of Zeek via
external files and gives us an added benefit.
This benefit is that we can make configuration changes at
runtime if it's via this type of file,
which prevents us from needing to restart the application
whenever a configuration is changed.
Zeek continuously monitors the files and uses the new information as it's added.
Nobody wants to have to reboot the system if changes are made,
and scheduling maintenance windows can sometimes be a huge pain.
The configuration framework helps us fix that.
The geolocation framework is a really nice addition to the tool that allows
us to utilize the city or country database from GeoLite 2.
This gives us some context information for the IP addresses that
we see in our traffic so that we can visually see the location of
the IP addresses in the strings.
We're able to use this information so that we can make intelligent
policies about our traffic within the network.
Everybody loves additional context for their data and for their logging today,
and this is a great addition to it.
Let me know if you can think of some good uses for
geolocation in Zeek's functions.
I'd love to start a discussion on this,
so ping me via social media and we can discuss it.
The inputs that Zeek allows is another one of the frameworks and
gives us the ability to be flexible with our information and
context that we get from the environment.
We can use this to input data into Zeek in two different ways,
through tables and through events.
Reading the data through tables forces us to define fields and values in
the tables and have Zeek use it in different ways.
We can also create updateable streams of information to use as inputs into Zeek,
allowing us to update things like IP blacklists and other
dynamic data types that could be useful to the Zeek
functionality in the environment.
I always like to say that what you get out of the tool directly
correlates to what you put into the tool.
This could be from both the input data perspective and from the
perspective of giving the system attention.
The logging framework that Zeek uses is based off of a key value system.
This allows us to control the functionality of how the data
gets logged and where it gets logged.
Streams, filters,
and writers all have their roles to play in the
logging mechanisms that Zeek uses.
You can create log streams or use the default ones,
attach filters to those streams to set specific parameters for the logs,
and use writers to define the format for the logs that
you'll be using in your deployment.
The logging framework gives us ASCII logging,
as well as logging to SQLite databases.
We can use external plugins to log the alerts and data in other ways as well,
such as through JSON format.
The NetControl framework is a really cool one that gives Zeek the
capability to interact with our network devices and perform
actions based on the events that we see.
We can configure an active response using this so that we can
perform actions like dropping connections,
stopping all routing and forwarding for a specific IP address,
or redirect a flow to another port.
These functions, along with many others that are available to us with this,
can also interact with a rule-based API so that we can add additional
functions to the framework and really customize the setup.
Some of the other frameworks that are available in Zeek that we won't
highlight too much in detail are the file analysis framework,
the intelligence framework, the notice framework,
the signature framework, the Summary Statistics framework,
and the Broker-Enabled Communication and Cluster Framework.
We'll be discussing the signature framework in much
more detail later on in the course,
but you can find additional information about these other ones in
the Framework section of the Zeek documentation.
All of these play their own part in allowing us to do something on the
system that adds to the capabilities of the Zeek tool.