Let's now highlight a few of the subcomponents of Zeek that give us the
capabilities that allow for easier processes within the system.
One of these that we discussed in a previous module was ZeekControl,
which is the interactive management shell that we used to help
deploy Zeek during the installation process.
Capstats is a nice tool that allows us to monitor network
interfaces and their usage statistics.
It can be used to perform analysis on the utilization or saturation of
particular links so that we can help troubleshoot certain issues.
Using this, we can see many statistics for the interfaces,
such as the package per second, the bandwidth,
dropped packets, and the amount of data being transmitted.
This subcomponent also allows us to see the number of packets per protocol,
such as UDP, TCP, ICMP, and even non-IP protocols.
The Zeek package manager does exactly what it sounds like.
It manages the packages.
It really does.
This is a command line tool that makes it easy for us to install and manage
packages and scripts to use with Zeek and ZeekControl.
What's really cool about this one is that it's set up by default to pull from a
special Git repository that has packages for Zeek within it.
A word of caution though, since this is a Git repo,
is that you should verify the code before you have the package
manager go out and pull it into your system,
just to ensure that it's safe and properly written.
This allows us to add capabilities to the system as well.
Finally, I wanted to mention the broker within Zeek as one of the subcomponents.
This one is all about the communication.
It's used for logging and alerting based on events,
and is responsible for the distribution of those to subscribers.
There are applications that you can integrate with the broker to receive
desired communications in specific formats as well.
Using the broker, you're able to fine-tune the messages that you get,
or the formats that you have available to you,
so that you can get the outputs that you really want.
Some of the other subcomponents that we aren't going to really
highlight here in this course are binpac,
zeek-aux, btest, PySubnetTree, paraglob,
and trace-summary.
These all add additional functionality and ease of use
to the system in their own ways.
For example,
the PySubnetTree is a package that allows us to map subnets
in CIDR notation to specific Python objects using lookups of
the longest-matching prefixes.
Using something like this,
we're able to define the subnets for various resources,
companies,
departments or other categories that we deem necessary so that
we can sort all of the data effectively.
All of these components are really cool and natively
come with the Zeek application.