First thing I'm going to do is change over to my Zeek user.
As you can see, I have the man page come up here,
and that help command just prompted an error to
give me some of the usage options.
What we can do is,
to install that package we can just hit zkg install and then
type in the path of the actual package.
So if we hop back over to our browser,
we can see that the package is the 0xxon and then the /tls‑log‑alternative.
In reality, we have to look at the GitHub address up here,
so it's going to be zeek‑tls‑log‑alternative.
So let's type that in and watch it install.
All right, and as you can see, the package installed successfully,
so we're good to go there.
We'll go check out that script in a second.
Before we go look and see how the script's going to interact with the system,
we're going to go ahead and modify our local script so we
can make sure that the packages are going to be used when
we hit the deploy command.
So let's go ahead and modify the local script,
mine's in the usr local directory, and scroll all the way down at the bottom.
And your local Zeek script should have this load packages command
in here that you just have to uncomment out.
If you already have packages in your environment then you
should already have this uncommented or you have your own
custom way of getting the packages active.
So I'm just going to uncomment that so we can use
the packages that we downloaded.
Let's save it and then exit.
And then I'm going to use the zeekctl deploy command to
deploy our new configuration and get it going.
So now that that's running, our new TLS package that we downloaded is active,
and it's looking for additional information.
And if we hop over to the browser and look at it,
it's showing us that there's going to be a log file called
tls.log now that contains a lot of that low‑level
information about the TLS handshake.
So let's see if we have that log yet.
We're going to use the cat command,
and the logs are going to be in your zeek home folder in the
logs directory and likely under current,
if it's the current deployment.
And as you can see, we don't have a tls.log yet.
So I'm going to hop over to my main controller and just try to connect
to Microsoft to generate some sort of TLS handshake.
And let's hop back over to Zeek and see.
And as you can see, now we have that tls.log,
so let's look at that and see what kind of information we have.
It formatted in JSON, but I did not do the print pretty command,
so let's just go ahead and jq that so we can look at it
a little bit more nicely formatted.
And so we have the hash algorithms and the supported versions,
the key exchange modes, the server certs,
so on and so forth.
So as you can see,
this is a lot more granular information about the actual TLS handshake.
Now if I was to look at the same information with the SSL log,
you see we don't quite get that much information about it,
so each one of these gives us some information about the cipher and
the curve and the server name and stuff like that,
but it wasn't as granular as that TLS handshake information that we got.
So let's check out that script real quick and see how it operates.
So as you can see,
the packages that are downloaded are downloaded in a site folder,
so your local Zeek folder, and, oops, might help if I had the actual script here,
so the tls.zeek script is where it is. And it's just a
script that's calling some web hooks,
scraping some information off of what it detects in the
packets, it's creating SSL extensions, events, and stuff like that as well.
So we have session established events and so on and so forth so it can use it.
I'd encourage you to check out the scripts that you're downloading with the
packages as you're downloading the packages. That way if you need to modify them
for any reason or so you can fully understand what they're doing with the Zeek
environment and ensure that it's both configured correctly and it'll operate
correctly in your own environment.