You've learned about Zeek signatures,
you've learned about the logging and notice frameworks,
and understand the scripting components and what they're all used for.
Before you build your script,
you should better understand those that Zeek comes with and how to
tune and optimize them to suit your environment.
That's where this module will help.
When it comes to the Zeek scripts, there are some nuances that we should discuss.
One of those is that we shouldn't edit the base scripts directly.
We have our local.zeek script that we've been using in that
site folder for modifications to the system.
One of the reasons for this is because there's a chance that Zeek will
override those base scripts during updates and patches.
We'll take a look at the base scripts in the next clip.
As a general rule,
all of the scripts that are located in the policy folder are situational.
These are run explicitly and focus on specific use cases.
For example, we have one where we're detecting a TCP scan.
It's not really loaded by default,
but we can run it manually or add it to our local.zeek script if we wanted to.
So there's two different ways that we can use to run scripts for use with Zeek.
You've seen them both in this course already,
but we'll run through them really quick.
The first one is through the load directives in the scripts themselves.
If we want to run them when Zeek starts,
then we can add them to that local.zeek script.
The second method is manually running Zeek just for
use within a specific script.
You saw this in the previous modules with me using the zeek command.
This is run either using the ‑b option or not,
which, if in the command,
it tells Zeek to run in bare mode with minimal other scripts.
We'll get to that in a little bit more detail later on.
One data type that I want to highlight really quick is
the connection record data type.
I know we've seen and heard about this in the previous modules,
but here's where we'll highlight the benefits and uses of it.
This is considered the backbone for many different
scripting solutions within Zeek.
Essentially,
this data type is passed to many different events within Zeek to be used.
This is also a part of Zeek's core functionality,
tracking connections between the source and destinations.
It has three parts according to Zeek's documentation.
These are when there's a new connection created,
when one times out,
or when the connection record will be removed or forgotten by Zeek.
If you notice the script that we had in the previous logging module,
we were passed a connection record into our ICMP event.
We'll highlight this use a little bit more in the next module,
but the important takeaway is to be sure to know that this will
likely be used in some form within your scripts if you're worried
about figuring out anything that has to do with the connections
going across your network.