As I mentioned earlier,
there are also bigger packages or add‑ons that you can install
to help add even more capabilities to Zeek.
There are things that greatly expand the capabilities by
integrating Zeek with additional technologies.
We're going to focus on Spicy here, but we'll talk briefly about some others.
Things like the message broker and additional analyzers
can be included in this category.
In reality,
all of the add‑ons and integrations that we've talked about so far
in this module are all additional scripts or extensions, and the
words we're using are just logical labels.
They're all add‑ons in some sense.
I'm referring to these larger ones as projects so I can separate the logic
behind some simple scripts and larger packaged add‑ons.
The Zeek Agent is another one that comes to mind.
I know I mentioned it just a little bit earlier.
This awesome tool gives us endpoint monitoring to
provide us with host activity within Zeek.
It'll report things like file, socket,
and process events to the Zeek application.
What's really cool is that this can interface with OS query and allow us to
gain a lot more endpoint information than just the file,
socket, and process events.
Remember, this is an open‑source tool, so the deployment costs are minimal.
And now for the focus of this clip: Spicy.
We'll be installing and demonstrating Spicy in the following demo.
What Spicy is, though, is a parser generator.
We can use it to create parsers using C++ to help us
expand the capabilities of Zeek.
So this gives us new protocol and file analyzers within the Zeek tool
so that we can make sure that we keep up with the latest trends for
analyzing our data and detecting threats.
What I really like about this is that it comes with a Zeek
plugin that allows us to add these additional analyzers
without having to know C++.
I think that's great,
especially for those like myself that may not be as great at
programming as many others in the industry.
There's even a package for additional Zeek analyzers that we
can use the package manager to install that gives us new
analyzers that are Spicy based.
Let's not waste any more time, and let's see what the Spicy project can give us.
We'll check out Spicy and make sure it's installed and explore the capabilities.
Then we'll dive in and build a really simple analyzer based on the Zeek
documentation and show how easy it is to add them.
Let's hop back into that lab.
And here we are back in that lab.
Real quick, before we go ahead and install Spicy and see what it can do,
we're going to go ahead and look at the Spicy documentation.
So this is Spicy's documentation right inside the Zeek documentation page.
And what it does is it gives us a really good overview of what the tool does,
how we can install it, and how we can get started in building our own analyzers.
It talks about the Spicy programming language and
how to integrate Spicy with Zeek.
So what we're going to do in this demo real quick
after we install Spicy itself is,
we're just going to use this basic HTTP parser that's here
and show how Spicy can work with that.
And as you can see here, we have the script already built for us,
so what this is going to do is it's going to analyze an HTTP
header and give us some basic information about it.
And now this is just to demonstrate the capabilities of
building your own projects or packages and using Spicy to
build your own analyzers if needed.
If you'd like to learn more about how to do it,
there's this awesome tool that shows you how to program inside of
Spicy if you need to create your own analyzers,
and like I said,
it'll give you also a tutorial on how to build an even bigger
analyzer instead of just a simple HTTP header analyzer.
All right, so let's hop over to the CLI real quick,
and now that we're here, we're going to install Spicy.
I need to get over to my home directory real quick to be able to do that.
And as you can see here, I have the Spicy installation file there,
so all I'm going to do is use the package to install it. And you can
download this straight from the GitHub repo and compile it or Zeek's
hosted repository that has Spicy in there. And we're going to let this run
through the installation setup real quick.
I'm going to speed up the video so we can get straight back into it.
All right, now that the installation's finished,
we're going to look and see where it's installed, and it is in the opt
folder, so you can see that Spicy is installed right there.
And so we're going to just change the ownership of it real quick to my Zeek
user since that's what I'm going to be running it from.
Might help if I use sudo for that one.
All right, so now let's change over to the Zeek
user, and now that I'm a Zeek user,
I'm going to go ahead and build my environment variables real quick.
All right, now that that's done,
let's hop over to the Zeek user directory, and look at this.
So we have a pcap file that we're going to use to run this Spicy analyzer.
We have my actual analyzer,
we have the event setup and then the script for Spicy itself, and we'll
check out all these in a second. And before we go check those out, what
we're going to do real quick is install the Spicy plugin just like we
installed that TLS plugin earlier.
While this is installing, what's really cool about Spicy is it has
the ability to compile code on the fly, and we'll show that in a
minute, as soon as this is installed. We'll create our own quick
Spicy module just printing Hi, I'm Joe.
Even though we got those errors after running the unit tests,
which could take 10‑20 minutes,
it's still going to work for the script that we're going to use.