Technology integration has been a focus in the industry for some time now.
It allows our technologies to talk to each other, to work together.
As cyber security threats evolve, our tools and processes must as well,
prompting for our need to have multiple security
technologies that can integrate with each other.
Imagine being able to use automation and integrations to detect a
potential attack or indicator of compromise,
send the information to a platform that can correlate it with
other intelligence to validate the event,
and stop its communication to the outside world.
Hi, everyone.
I'm Joe Abraham, and welcome to my course,
Extensions, Frameworks, and Integrations Used with Zeek.
You're here to learn about integrating one of our
favorite network security monitoring tools,
Zeek, with some other tools to learn what other benefits it can provide.
You're going to learn about the various integrations
with Zeek and practice a few of them.
This will help us get an understanding of integrating
security tools and the benefit that it could provide working
towards that nice, automated setup.
And if you're new to Zeek or need a refresher on it,
Pluralsight has some other great courses in this learning path that you
can check out before moving further into this one.
So Zeek is a network security monitoring tool that enables us to see and
analyze traffic as it's coming across the network.
It's a passive tool that's open source and has the capabilities
to see what's going on with HTTP sessions,
DNS conversations, and web applications,
to name a few.
This is all out of the box too.
It can be used as an IDS or just as a network traffic analyzer.
What's awesome about this is that it's not just using a
signature‑based approach; it also uses other mechanisms to
detect threats and help analyze the traffic,
which expands the capabilities beyond the traditional IDS approach.
That's what we'll focus mostly on in this course.
In this course, you're going to learn all about Zeek's integration capabilities.
I'll be focusing on a few different areas surrounding this.
I'll jump into how the input,
configuration, and net control frameworks work so that
we can understand those capabilities,
along with the general information about Zeek extensions,
scripts, packages, and other integrations.
Then you'll learn all about Zeek's role in the popular platform Security Onion.
After that, I'm going to detail how to ingest Zeek logs into the ELK Stack,
as well as how to enrich the Zeek logs and map them to another tool's schema.
You'll learn about integrating Zeek with RockNSM as well.
And finally,
I'll show you how to use Zeek's Intelligence Framework and
figure out what we can do with that information.
In this course, we're going to be helping our friends at Globomantics,
Katrina and Chris,
figure out how to customize the tools to fit their environment.
Katrina is the security engineer working with Chris,
the SOC analyst,
to identify how the tools need to be used and how it will
most benefit the cyber operations teams.
Learning about the integrations that Zeek has with some of
their other security tools can help them focus on building
better processes within the SOC.
This course is part of a skill path at Pluralsight called Enterprise Security
Monitoring with Open Source Network IDS & IPS, and follows the Utilizing Zeek
in an Enterprise Environment or for Distributed Operations course. It will be
a very technical, in‑depth course,
learning about the integration options and how to use them.
It's highly recommended to take the Getting Started with Zeek course prior
to jumping into this one, so if you haven't done so yet,
you can check that one out as well.
If you're ready to move on and get started, though, let's jump right in.