Alright, let's hop into the lab and explore a few of these defaults that we have.
We'll take this time to check out what the scripts and directories
within the base and policy directory can do for us.
We'll take a look at those and then dive into the local.zeek script
again to see where and how we can modify that.
Alright, and here we are back into the lab.
We're back into our local site folder.
But before we get started and look at the actual local.zeek file,
let's look at that init‑bare script real quick.
So I'm going to go ahead and use more and then go navigate to
the script directory where that's being held,
which is the base directory.
And as you can see, we have a few different options here to choose from.
So we're going to go ahead and just do that init‑bare script.
And here we are.
So, by default, this loads the BiF constants and the BiF types.
And then it goes through,
and it has a bunch of declarations for sets of strings and addresses,
vectors, subnets, 509 opaques, just a whole bunch of different type definitions.
Scrolling down a little bit more, it has some constants that are defined as well.
So we have thresholds for checking for close connections
and checking for undelivered signatures.
So this is where a lot of the built‑in constants and global
functions that Zeek has and uses are defined.
Scrolling down a little bit more,
we have some functions that are defined as well.
We have records that are defined.
We have global messages that are defined as well.
So, like I said,
this script right here is the bare‑bone script that really drives Zeek's
functionality and all of the functionality that it loads when we're trying
to use it just from the basic perspective,
not even counting all the protocol analyzers and everything like that.
And speaking of those protocol analyzers and everything,
the next script that I wanted to look at is the defaults one.
And this is where Zeek loads all of those things.
So, this is where we're loading all of our utilities for file checking,
and URL, and time.
This is where we're loading the different frameworks that we have,
so our signature frameworks loaded by default,
our notice frameworks loaded up by default,
the intel framework.
And then all of the protocol analyzers are also loaded by default,
so we have FTP, NTP, POP3, RADIUS.
All of these protocols that are built into the base
directory are loaded via this default script.
And remember, this one is not loaded if we're using that zeek‑b command.
We're only going to load that previous one with all of the
object and type and constant definitions,
all the global definitions.
So the init‑bare script loads the Zeek infrastructure for it to use,
and then this one loads the various scripts for analysis and how it's
actually going to ingest and analyze the traffic.
Before we hop into that local.zeek script,
we'll go and check out the tuning folder.
And as you can see here,
we have two scripts that we'll cover a little bit later on in
this module in the default folder here.
But essentially, this folder right here is where we can stick our tuning scripts,
and Zeek comes with about five of them built in to modify the various
parameters within the ecosystem that we want to just modify.
And like I said, we'll cover this one in a little bit.
So now let's take a look at that local.zeek script.
Now we've seen this throughout this course so far in each of the other modules,
but what does it actually have in it?
Well, we have all of our miscellaneous scripts that are loaded.
We're actually loading some of the tuning scripts in that tuning folder,
just the default one, so there's three of them that are in there.
We're loading scripts for capture loss per stats.
We have that TCP scanning script that we mentioned
earlier in the course that's not loaded.
We're not loading the detecting traceroute activity.
We are loading some protocol frameworks as well.
We are loading some scripts that help us detect software within certain
protocols and when we're using external names in DNS.
When we're talking about customizing the Zeek system,
we can comment out any of these that we don't want Zeek to load
and that we don't want Zeek to actually use.
So if we're not interested in detecting brute force over SSH,
we can just comment that one out.
And when we're customizing this, this file does not get overwritten
with the updates, and patches, and stuff like that,
like I mentioned previously in the course.
So this is a great way for us to build our own sections like I did in the
previous modules where we have this signature framework loaded, and we
have our specific signatures that are here.
So build your sections in the local.zeek script to invoke the
scripts that you want it to run all of the time,
and also comment out all of the ones that you don't want it to run.