Okay, so we have our frameworks and we have our subcomponent.
There are a lot of those.
Now we're going to dive into plugins really quick and
describe some of the capabilities that these provide Zeek
from a usability perspective.
Plugins are great tools that allow us to add features
or use cases to the Zeek system.
The plugin API that Zeek provides enables us to extend the
system functions as I stated earlier.
We can use these plugins to enhance several aspects of the Zeek functionality,
such as adding additional scripts,
adding additional analyzers for protocols or files,
change up the logging framework to add new output types,
and help us increase the ways that we can input data.
We can also use plugins to help pull information
from additional package sources.
Essentially,
we can write some code to interact with Zeek and change the
way we use the system for the better.
With today's technology,
everything is about integration and the sharing of information.
Through these plugins, Zeek gives us this capability.
Whatever type of code you decide to write,
you'll need to refer to the Zeek doc library to ensure that the API
or plugin that you create is compatible with Zeek.
Zeek needs to recognize your code as a plugin,
so be sure to pay special attention to the directory layout.
If you get it wrong, the plugin may not load.
The nice thing about these plugins is that they're able to utilize Python,
which is a very standard programming language for APIs and automation
so that you can take advantage of the fact that you may not need to
learn a new language to speak to Zeek.
Really quick on the topic of plugins as an example of what these can do,
you can really write a new package for anything you can think of
that relates to the traffic that Zeek can see.
So let's say you need to detect a specific type of attack with Zeek.
Well, you can write a plugin for it to tie to a particular detection engine,
or look at a specific signature or rule for that attack.
Or,
you can write a plugin to export your alerts and data into a SIM that
automatically tags your events in a certain way so that it's easier
to search and sort from within the SIM.
The possibilities here are vast, as with many network monitoring solutions.