Let's talk about packages now.
Zeek has a package manager that allows us to install
third‑party scripts and plugins.
This package manager makes it very easy to get add‑ons and
integrations into the Zeek system for use with the tool.
Let's take a look at some of these things that we can do with the packages.
We can find the packages to download in a few different places,
but the main two are at Zeek's official website and in their GitHub repo.
When downloading the packages using the Zeek Package Manager,
they're pulled from GitHub.
You can install your own packages or other third‑party ones as well if needed.
This gives us even more capability,
as we can develop our own and manually add them into Zeek.
So what kind of packages are available?
Why would we add any of these?
Well, out of the box,
Zeek does a really good job with a lot of traffic processing,
but each of the packages helps expand its capabilities by
adding additional use cases that it can support.
Take this one, for example, the Zeek plugin for IKEv2.
This package enables Zeek to parse IKEv2 protocol traffic and
give us insight into the initial SA set up and tells us the
ciphers being used and the SPIs as well.
Or what about this one?
Collaboration software has been increasing in popularity as
remote work and meetings have become more common.
This one detects Zoom traffic and gives us
information about the initial connection.
It'll tell us about the Zoom connection and the servers
that the clients are connecting to.
Or we can go a completely different direction and use a plugin that
adds the GeoIP data and the reputation scores.
We can add this information to generate notices if thresholds are crossed for
the reputations of the places that we're visiting on the net.
Before we can download the packages,
we'll need to install the zkg, or Zeek Package Manager.
You can do this by either manually installing and configuring
or using the preinstalled version of it.
The documentation here can help you identify the steps
to take for your specific deployment.
I'm going to be using the default installation for zkg that
comes with Zeek 4.0 and later, and with that, as long as the
other dependencies are okay,
I'll use the command zkg autoconfig. In the next clip, we'll
go through and look at some of what we just discussed and see
the package manager in action.