Let's dive into the many options and pieces of the scripts that we have
available to us using the Zeek scripting language.
This is by far not an all inclusive list, and more
can be found in the Zeek docs,
but this should give you a good idea of what we have to work with.
So the first data type is operators, and Zeek supports many of them.
We have relational operators and logical ones.
We have arithmetic operators, and set operators, and pattern operators.
There are so many to choose from.
We can even do things like membership tests that can be used
to validate that something is in another value, along with
conditional operators as well.
Here's some examples of ones that we have to work with.
I'm sure some are familiar to you and others may not be.
The more you work with Zeek scripts,
the more familiar you'll become with these. Types are the
different types of data that we may see or the different
things within the scripts.
We have numeric and non‑numeric data types, similar to other
programming languages like integers and strings,
container types like records and sets, executable
types like our events and hooks.
We have file types and enumerations that can be done
and pattern types using regex.
So, an example of using this type would be something like the interval.
This is a temporal type for relative time and can be written as a
numeric constant followed by a unit of time,
let's say seconds or minutes.
So similar to functionality in searches within
SIEMS or other log searching tools,
we can define a time window for the past 4 hours, for example. This
can be useful in identifying specific actions or events within a
certain amount of time as a potentially worrisome event occurring.
Attributes help us define the data within Zeek that it sees and
uses. For example,
the &redef attribute that we have seen in previous script
examples allows us to redefine the global variables and
constants like log file names.
The &log attribute allows us to write a record field or a
container type to the associated log stream.
And we have default attributes and the ability to add or delete
functions that are called with them as well.
These attributes always map to actual values of data,
whether it's a specific record definition or integers that we're using.
And if you take a look at these, all of them begin with the ampersand symbol.
So keep that in mind when you're creating your own scripts that you need to have
the ampersand in front of the attribute in order for it to function as an
attribute. Declarations and statements are something that should be familiar if
you're used to programming languages as well.
The declarations identify global variables, and constants,
and modules to be used within a script.
Redef is one that can be used to redefine the values like mentioned before
in the attributes, and we can even redefine types that we want to use in the
scripts. Statements like local, add, delete,
print, for, while, and if, these are all appearing after global
declarations and can do things like identify local variables,
add or delete elements, and create loops that we may need to use.
These statements can be local or global, and the type must be specified one way
or another. Directives affect the scripts being loaded or not and which lines
in the script will be executed. If you remember earlier in the course when we
were using the signatures for detection,
we saw two directives in the local.zeek script. One was the
@load directive and the other was load‑sigs.
These directives instructing Zeek to load the frameworks
and signatures that we told it to.
We also have other directives that help us load additional plugins and
prefixes for scripts, and we can even use them to evaluate potential if
then statements using the if and else directives.
Just think of these as the ways to control the scripts that we're going to use.
Now take a look at this example script that comes built within Zeek. Using
just this cross section of it, we can identify almost all of the different
options, and types, and attributes, and declarations it's using. We can
identify the various types that it wants here and the attributes that are
helping us define or redefine values.
We can see the declarations and statements and the directives to
load the various parameters for the script.
We can see and identify all of the components that help us build the
scripts. With this information, we're going to hop into the lab
again and pick out all of this using the traceroute script. In the
next clip, we'll do just that.