So Zeek's functionality is driven by data. Without it,
Zeek wouldn't be very useful at all.
It tracks the data that it sees on the network and extracts intelligence and
other data from that traffic to be used within the system.
It's necessary to identify and understand many of the data
types and structures that Zeek uses in order to be able to
manipulate the scripts themselves.
There are three main ways to identify, reformat, and make use of the
various components of the scripts that we need to understand.
This is through the use of global variables, local variables, and constants.
We spoke briefly about constants a little earlier in the module, but
haven't addressed the other two specifically yet.
So, what are they?
Well, global variables are what they sound like.
They are used globally and can traverse different
scripts to be called as needed.
The module name in the first section of the script is used for this since
we have to call global variables using the module name,
colon, variable syntax.
Local variables do not apply to the entire deployment and
are only available within the local scope.
So, this would be applicable within an individual event body or
function, essentially wherever it was declared.
It's important to remember that these are only locally
significant and are deleted once no longer used.
Constants are set and altered when Zeek is parsing information,
but when the system is in runtime, they cannot be changed.
We can redefine constants in Zeek scripts if we wanted to.
These modifications can be considered either globally or
locally, depending on our configuration.
Local modifications of these would be through the individual scripts using
them, and global ones would be done in the local.zeek script.
Zeek's data structures are made up from various data types,
so diving into each structure may not be beneficial to us in
this course. We have some atomic data types that are used
within Zeek, which are shown here.
Many of them may look familiar to you if you're familiar with
other programming languages and their data types. We can use
integers and floating point numbers.
We have the ports, and subnets, and times, as well as the
ability to use regex as a data type.
We can use boolean as well to validate true or false statements.
We have three components or variables of data structures that
you should learn about as well if we're talking about Zeek
data specifically. These are sets, tables, and vectors.
A set is what's used to store the elements of a data type.
Think about the sets as a container of interesting values, which
could be a set of ports or IP addresses or something else that's
identifying the data. Sets may be different, depending on the
traffic that we're ingesting.
These are defined using the format
variable_name:set[type], or instead of the type,
we can add the data definitions.
The scripts can use these sets to use if then statements to print the
information or use it in generating actual events.
You can think of tables in Zeek as key value pairs.
Each key is defined as something, and then the values are placed after them.
We can use this information in scripts as well to map what we're seeing on
the network to actual useful intelligence information.
We can have multiple data types within a single table, too.
If you're wanting to explore the capabilities of this,
you can use language similar to many programming languages to print
the information in a script such as defining a table as output to
check the data that you're inputting.
The vector data type is an interesting one.
It's similar to arrays in other languages,
but within Zeek,
these are more efficient than arays. These allow us to
sequentially store data of the same type.
Consider this a collection of objects within the same data type.
We can add or remove data from them as well.
We're not going to dive very deep into vectors in this course.
But as you get more advanced with your scripting capabilities,
you can use these, restoring elements and iterating them
in the scripts that you're running.