Now it's time to break down a full Zeek script and identify
everything that we've covered in this module.
You're going to take a look at the traceroute script that we
mentioned earlier in the module as our example and use it to
understand how the script functions.
Let's get this figured out.
All right, and here we are in the lab.
The script that we're going to be looking at in this one is the detect
traceroute one that we've been talking about for this entire module.
So,
let's go ahead and do more for that one and see if we can pick out
some of the different items of the script and components and options
that we were talking about previously.
So, as far as operators go, we don't really see too many in this script.
What we do see is a bunch of different types.
We're using different sets, as you can see here under reducers.
We're using the operator equals here for the $sum == 0.
And we have quite a few attributes that we're defining here as well.
Remember, the attributes are denoted by the ampersand sign.
As you can see here with these &log statements,
or the ampersand log statements, we're defining a record type,
as we noticed that we did the same thing back in the previous
module as well for the logging framework.
So, we have those attributes there for the log.
And there's also some redefinitions here for the constants.
And speaking of constants, that's great that we were able to see these.
Now scrolling up, we have our declarations, right?
We have the redef declaration.
We're redefining this one right here.
We have our module declaration that is called Traceroute,
we have our export declaration with all of the redef information in it,
and our log attributes.
So what's really nice about Zeek's documentation is that a
majority of their scripts are pretty well documented,
and the comments tell us what each piece does.
So, for this redef statement right here,
we're going to send a notice out for it if it's detected.
So the notice type is actually going to be redefined as
Detected for this particular instance.
We also have global declarations in here as well where
we're calling on the log policy hook.
And we also have some statements in here as well.
So we have a lot of if statements,
and scrolling down we have the local statements that are telling
us that there's some local variables that we need to keep in
mind for this script in particular.
And so we have all these if/else statements as well that I just
mentioned within the actual events that are being defined.
And if you look at this return statement here too,
that's an important statement that's used in a lot of scripts because it
returns us from the function or hook or the event handler,
whatever it's in, into the main part.
And then, finally, the directives.
So the directives are always at the top of the script.
And so here we're loading the summary stats framework,
we're loading the signatures framework,
and then we're loading our actual signature.
So those are the only directives that we have in this particular script here.
And so all of these components, the directives,
the statements, and declarations, the attributes that we see here,
the operators that we see here,
all of the different pieces that we've identified,
all work together in order to create the full script and make it operational.
So essentially,
how this script is broken down is we're using our directives
and loading the frameworks and signatures,
defining the module, defining the export,
we are redefining the different log types that we're going to use and
the notice framework pieces that we're going to use,
we're redefining any constants that we need to know
about or use in this one as well.
We are also going to define the record type for the logs and
what fields we're going to be gathering for it.
And we're also making sure that we use that attribute log so we can
make sure that it gets sent to the actual logs.
And then we have our event handlers that are allowing us to
define what happens whenever we see the event.
So as I mentioned earlier,
we have the initialization script that creates the log stream and defines the
local variables and attributes for the logs themselves.
We have the if/else statements in here that tell it how to handle it as well.
Then we have those two other events that we spoke of earlier
where it's really just the if/then statements,
and we're focusing in on the different variables and the different
options that will define this event actually occurring.
So if we see that there were a low amount of TTL packets,
then we're going to pass along things like the connection ID and
the originating host and the responding host imports and use that
information in the logs themselves.
And there we are, finished with this demo.
I feel like we were able to solidify the knowledge about various scripting
components and so many of the variables that we can use for them.
We learned about event handlers and queues,
as well as the data types and structures that we can use.
We also took a look at the script reference to identify all of the many options
that we have available to us to customize the Zeek system.
Be sure to refer back to this demo and module if needed later on
in the course as we're building our scripts.
We're going to learn more about Zeek scripting by way of the defaults.
We'll dive into how the system is initially set up and
how we can optimize the deployment.
We'll also dive deeper into the scripts themselves to prepare for
the final module where we'll build our own.
Join me in the next module.