Our IT infrastructures are complex.
Our security posture is constantly being evolved and improved.
Our businesses rely on so many 1s and 0s that it's difficult to keep track of.
To better secure these environments,
we have many different solutions available to us,
but not many of them fit our needs out of the box.
They require at least some sort of customization.
With network security monitors like Zeek, this is especially the case.
Zeek is a network security monitoring tool that enables us to see and
analyze traffic as it's coming across the network.
It's a passive tool that's open source and has the capabilities
to see what's going on with HTTP sessions,
DNS conversations, and web applications,
to name a few.
This is all out of the box too.
It can be used as an IDS or just as a network traffic analyzer.
What's awesome about this is that it's not just using a
signature‑based approach; it's also using other mechanisms to
detect threats and help us analyze the traffic,
which expands the capabilities beyond the traditional IDS approach.
These expanded capabilities are what we're going to
focus on here in this course.
I'm going to teach you how to customize Zeek through some
of its frameworks, and we'll focus on both signatures and
scripting to get us there.
You see, Zeek runs on scripting.
Its default configurations and base functions are all done via scripts.
This approach gives us an advantage in multiple ways.
First,
it allows us to fully customize our deployment and turn on or off each
individual detection or analysis type that we want or don't want.
Second,
it allows the system to expand beyond its original intentions and capabilities
by calling external data or systems to help with the process.
And third,
the scripts go beyond basic signatures and allow us to look for
behavior or patterns that don't necessarily make sense.
So Zeek is very customizable, and we'll learn how to do that here.
Hi, everyone.
I'm Joe Abraham, and welcome to my course, Writing Zeek Rules and Scripts.
In this course,
you're going to learn all about Zeek's rules and scripting capabilities.
I'll be focusing on a few different areas surrounding this.
I'll jump into how the signature framework works so that we can
understand those basic detection capabilities.
Then you'll learn how to manage events using the logging and notice frameworks.
After that, I'm going to break down the scripting basics for you so
that you can better understand how they work and how they interact
with the system and what we're trying to do.
You'll optimize a few of Zeek's default scripts that come with the system next.
And finally, I'll show you how to customize the Zeek functionality using the
event‑driven scripting language to support our use cases.
In this course, we're going to be helping our friends at
Globomantics, Katrina and Chris, figure out how to customize
the tools to fit their environment.
Katrina is the security engineer working with Chris,
the SOC analyst, to identify how the tools need to be used and how it will
most benefit the cyber operations teams. Learning about the scripting and the
various frameworks for Zeek is an important step in getting the right
detection and analysis mechanisms in place.
This course is part of a skill path that Pluralsight called
Enterprise Security Monitoring with Open Source Network IDS & IPS
and follows the Getting Started with Zeek course. It will be a very
technical, in‑depth course learning all about the customization
options and how to use them.
It's highly recommended to take the Getting Started
course prior to jumping into this one.
So if you haven't done so yet, you can check that one out as well.
If you're ready to move on and get started, though, let's jump right in.