Welcome back.
In the previous module,
I talked a lot about the Zeek signature framework and how you can use
that to detect specific signatures within our network,
such as using telnet to connect to a device or HTTP to
navigate to a web server database directory.
In this module,
you're going to learn about the logging framework where we can view
and customize the log output that Zeek provides.
I'm also going to be covering the notice framework and learn about how that
interacts with the system to provide us additional capabilities.
When we're talking about logging with Zeek, the framework is very flexible.
It uses the typical key‑value based approach and the framework can be
extended through various integrations and modules.
So when an event of some sort occurs, whether it's neutral or not,
the event typically gets logged within Zeek.
These logs can be used for additional analysis,
monitoring and alerting, or for record keeping.
There are three components of the logging interface for
Zeek that we need to be concerned with.
There are streams, filters, and writers.
I'm going to deep dive into these later in the module,
but let's get a good baseline of what they do within
the logging framework for us for now.
So the log streams are the individual logs that Zeek keeps,
and each one has definitions of the specific fields that the log consists of.
For example,
we have the weird.log stream that would include all of
this log's fields and information,
or the DNS stream that captures all of the DNS requests and events.
The filters are what determine the information that
gets written to the logs and how.
These are where you can customize the options,
like where everything is written to,
the output type that we're writing the log to, and
things like the rotation interval.
Each log stream has a default filter built in that writes everything to disk.
For customization of this, though, more filters can be added if needed.
Keep in mind that if a log stream has no filters attached to it,
then it won't log anything.
The filters are must to define what's going to get logged and how.
Each log that we write to file uses a writer.
These give us the definitions and output formats
and tell Zeek how to log events.
We're able to log via ASCII format,
which is the default, or extend beyond that and log
into databases and other formats.
The writers typically include metadata of some sort in
the log files that describe the format,
the path, and the other variables that are useful in calling
these for other aspects of the Zeek processes.
There are other writers available for use with tools like
Elasticsearch and others, so explore them as needed in order to
produce the output that you're looking for.
All three of these components of the logging framework work together in order
to take advantage of the logging capabilities within Zeek, and understanding
them can help us figure out our left and right balance of what we can do with
it. In a little while, we'll take a look at each of these and see how we can
use scripting to customize them.