All right, let's get ready to hop into the first demo of the course.
In this one,
we're going to see the extensions and frameworks and look at the
packages that we can add to our Zeek installation.
Then,
we'll see the package manager and how it interacts
with Zeek to install the addons.
Let's get going.
All right, and here we are in our lab environment.
And right now,
I just have a few browser tabs pulled up so we can
check out some of the frameworks, look at the Zeek GitHub page,
walk through some of the packages that we can install for Zeek.
And then we'll hop straight into the CLI and install
one for detecting TLS activity.
So here on the Zeek documentation page, the first place that I
want to go to is just to look at the frameworks that we can use
with Zeek that we talked about.
So we'll take this time to look at the input framework real quick.
We'll look at the configuration framework and then the
NetControl framework real quick.
So if I'm hopping over to the input framework,
like I was mentioning earlier,
it allows us to read new types of data and read it into either tables or events.
Now we're not going to be showing this live in the demo,
but you can look through the documentation and see exactly what you can do,
how you can configure it to manipulate your data in different ways
and give you additional events and information for Zeek to process
and help you detect malicious activity,
your specific activity that you're looking for.
The next framework we'll go look at is that configuration
framework that I was talking about.
So this one allows us to easily use options when we're running Zeek via commands
and stuff like that to give us the ability to, like I said,
turn on and off different features, do things like change the host name,
or create different variables as you're starting Zeek up.
So this allows us to modify the configuration at runtime
essentially without having to hop into the scripts.
You can see here that we have some redefinitions and stuff like that that
you can use that Zeek's given us as examples there.
So that's another thing that you can experiment with to allow yourself
to change how Zeek is going to function at runtime.
And then finally, the NetControl Framework.
This is what I was talking about that's pretty much Zeek's API architecture.
And what this does is allows us to configure Zeek to interact
with other network devices or other security technologies like
the switches and routers and firewalls.
And so essentially what we can do is we can create rules in
here for when Zeek detects specific traffic,
it'll send a message or send some sort of instruction to
have the network device drop the traffic or block the
traffic or do whatever it needs to do.
This is essentially part of Zeek's API documentation.
So you can look in here and see just how to interact with the API if
you want to build your own to interact with Zeek,
and it gives you all of the functions that the NetControl Framework
uses so you can actually use them in Zeek policy.
All right, the next place that I wanted to show you is Zeek's GitHub,
and it has a lot of packages and some projects that we can install.
Like I said, we have ones that allow us to get NIC stats.
We have the Zeek agent right here.
So that's a project that is a really cool addon to
Zeek functionality that can help us.
I'll talk about that in a little bit.
But you can go in here and download the code for that.
And then we can use other addons.
There's addons for creating packages to help with scripting.
There's addons to help with creating new analyzers.
Or we'll talk about the spicy plugin later on in this module.
We can have Docker files for building Zeek in here as well.
So their GitHub page, it's not just the packages and projects.
It's other helpful scripts and tools to use to help
you interact with Zeek as well.
In their repo, it has some of the packages that we can install,
but it also has some of the larger projects that you can
install and add on like the Zeek agent and spicy.
And like I said, we'll talk about those in a little bit.
Now finally, the Zeek Package Browser.
This is a great tool to actually go in and explore the
packages that we can install with Zeek.
So it gives you instructions if we're using the Zeek
Package Manager on how to install a package.
We can explore the packages.
We can look at GitHub repository from here.
If you don't already have zkg installed,
you can look at the quick start guide right here to best see how to install it.
So let's look at some of the packages here.
Like I said in the previous clip,
we can add packages that give us additional logging types for JSON data.
We can download packages to manage block‑listed IP addresses.
We can download addons to help analyze HTTP/2
traffic or set up the bro interfaces.
So the extensions and packages that you can install on Zeek,
there's a lot of them in here.
I'd encourage you to explore the package browser and figure out if
there's any scripts in here that align with the use cases that you're
trying to establish in your environment.
Or if any of them just look cool,
go ahead and download them and see if they can work in your
environment or how they work in your environment.
Now one of the packages that we're going to install today just as part
of the example is going to be a TLS script or a TLS package that
allows us to log some additional TLS data.
It's a really simple script.
It's not very difficult to install.
And what it does is it gives us additional information about the key
exchange and the protocols and ciphers that are used.
And so what we're going to do is we're going to hop into
our Zeek environment and go ahead and install this and
just validate that it's working.