If you've seen the Getting Started course for Zeek or
looked through the Zeek documentation,
then you may be familiar with this diagram.
We're going to be hitting these in varying details throughout the
course so that we can properly learn the scripting and rule
writing that can be done for this tool.
It's important to understand how Zeek's architecture works in order to dive
into those and learn the various frameworks and tools.
So, as Zeek sees the packets on the network, the event engine creates events.
The policy script interpreter takes those events,
and, based on what's configured, we'll get logs,
notifications, or other results.
The name of the course includes scripts and rules,
so we'll focus on both of these areas.
The event engine, though,
has several subcomponents within it that help us turn the packets into
higher‑level events through premade subcomponents and scripts.
So we have these subcomponents that consist of things
like the various input sources, packet analysis,
session analysis, and file analysis.
These can give us the ability to process protocols like SSH and HTTP,
lower‑level protocols, files, and more.
What's cool is that you can build your own using the Zeek plugin architecture.
By default, Zeek can use these out of the box with little to no configuration.
But that's not why we're here.
We want that customization.
So when we're talking about our network data types,
we have four different types, full content,
transaction data, extracted content, and alert data.
These data types can also be shown as recording traffic,
summarizing traffic, extracting content,
and judging the traffic.
These are the four different data types of network
security monitoring data within Zeek.
Zeek has the ability out of the box to collect two to three of these types,
just not the full content or the recording of the traffic.
Where Zeek's bread and butter is resides in the transaction data.
We need to know about all of these different data types to
be able to write these custom scripts that we want to be
able to customize the system.
We're going to be creating those rules and scripts using the data
that Zeek extracts from the traffic that it sees and perform an
action on those higher‑level events.
So, let's pretend Zeek is sniffing the wire and we're using it out of the box.
It sees the traffic and it uses its various analyzers to process that traffic.
Each analyzer has different information that they extract
and place the extracted data into neutral events that are
typically added to various logs.
These logs can be used to make determinations or start an investigative
process to determine whether those events are malicious or not.
Most of these analyzers are located in the event engine.
Keep in mind that the events don't have to be written to log files.
They can be customized to include things like sending emails and alerts,
updating certain metrics, or calling another script.
I'll dive into all of those workflows and make the architecture a
little more clear as we move along through the course.
For now, though, remember that Zeek ingests traffic or files,
extracts information from them, and uses that information in some way.
Your job is to create or manipulate the scripts to add more
analysis capabilities or to modify the built‑in ones and do
something specific with the data after analysis.
We're going to start out by looking at the basic signature
detection on the network that Zeek comes with,
since this is still an important aspect of network security monitoring.
Zeek's specialty is in the other areas, though,
so we'll learn about the signature‑based detection here and then move on to
learning about how to manipulate and use the scripts.