And there we are, all finished with the custom script.
I'm really glad that we were able to walk through each section of
it and break it down into its basic components.
We were able to validate that it worked as expected as well.
Let's have a quick review of what you learned in this course and wrap it up.
We started out by talking about Zeek scripting in general and dove into the
signature framework. Here, you leared how to write signatures using either
the network‑based approach or file‑based approach.
The signature framework is just like using traditional
IDS or IPS rules where we're looking for specific
criteria in a simple signature file.
We used Telnet detection as one of our examples of
what we can do with this framework.
For the most part though, headers and payloads are the keys to using signatures.
After that, we detailed both the logging framework and the notice framework.
You saw how these could be used in order to generate the
logging and alerts that you may want in your environment and
how to customize them to suit your needs.
We walked through the components of the frameworks and the
actions and functions to use them with as well.
An example of this is creating a new logging stream and telling Zeek to use JSON
formatting instead of the traditional Zeek TSV formatting.
We then spent the next two modules going over the basic
script components in understanding how they're used in
building various aspects of the scripts.
We looked at the script reference and identified all of
the main options and components there.
After we spent some time deep diving that, we learned a little bit
about basic optimization and tuning and learned a few general rules
that we can use to help that effort.
We also took a look at the built‑in tuning scripts that Zeek has
to offer. And finally, you were able to see the script that I've
built for the use case in this module and what it does for us. As
simple of a script as it is,
it shows us the general concepts for building scripts within Zeek, and
hopefully, it'll get your mind working and thinking about the various ways
you can customize the system using your own scripts.
Now that we have that review done, let's close out this course.
Zeek is such a great tool that we can use to help identify
potentially malicious activity on the network and give us
information to investigate it properly.
It's open source and easy to work with as well.
I love how we can build custom scripts,
no matter how big or small they are to help improve its functionality as well.
We'll continue on this journey to learn Zeek better with additional
courses here, at Pluralsight. Course ratings and constructive feedback
are always welcomed and very much appreciated.
I take all feedback that I receive and actively use it
to try to make my content better.
So please, if you have time,
give my courses that you've seen a rating and let me
know what you think. On top of this,
you can also subscribe to me as an author here at Pluralsight so you can
be notified whenever my future courses are released.
There are and will be many cybersecurity and Zeek courses here, at
Pluralsight, so be sure to check out the other ones as well.
I have a lot of courses on Splunk and machine data in general,
as do other great authors here, so you can dig down into
learning about the data itself. Now it's time for me to turn it
over to you to keep on learning.
I really appreciate you viewing this course and hope
that you learned something new.
I hope that you've increased your Zeek knowledge
and have leveled up your skills.
Remember,
we're a community of professionals. Share your
knowledge and help build the community.
Thanks for viewing this course, and I'll see you in the next one.