All right, now that that's installed,
we can go ahead and validate that the plugin's ready to use.
We can use this command to do so.
And since that returned the support for Spicy parsers and the
different types of files that it'll take, that shows that
Spicy is installed and ready to go.
So now let's go ahead and create that simple Spicy script to print Hi, I'm Joe!
All right, I'm going to go ahead and save it.
And as you can see , we have that new joe.spicy
script that we just created here.
And now to demonstrate the compiler on the fly capabilities of it,
I'm going to use the command spicyc, followed by a ‑j,
and then the name of the script.
I have the wrong syntax.
And again I have the wrong syntax.
Might help if I had the last semicolon in there.
All right, here we go.
And as you can see,
it's taking it's time to compile the simple code that I just did,
and it spits it out, it prints it out on the terminal for me.
All right, so let me go ahead and believe that,
and let's get into seeing the Spicy analyzer and the scripts
that we're using to test out the rest of it.
So the first one I'm going to look at is my
joe_http.spicy analyzer that was created.
This is the same one that's in the Zeek documentation.
So you can go ahead and copy/paste that into here as well
and experiment with it on your own.
But essentially, it's defining some constants for us,
it's showing us the types and the units,
what to look for.
And then we have our definitions of what the fields are going to be essentially.
The next one that we're going to do is the actual event,
so this is us creating an event using that protocol analyzer,
joe_http.
And so this is essentially creating an event for Zeek to
use in relation to this Spicy analyzer.
And then finally, the one that we're going to use to call the Spicy parser,
the Spicy analyzer, and the event is going to be the Zeek script.
And we went over Zeek scripting in my course, Writing Zeek
Rules and Scripts here at Pluralsight,
so you can check that out if you want to get a better idea of the scripts.
But as you can see, it has the event that we predefined,
joe_http,
and then it's telling us what to print as a result of that event being called.
So we have the Spicy analyzer that analyzes the packets coming in,
or the pcap, in our case,
we have the event that defines an event to create
based on the traffic that it analyzed,
and then we have this Zeek script that calls the event and gives us an output.
In this case, it's going to print Zeek saw something happen from this host,
using this method, so on and so forth.
Now what we need to do is check out the Zeek plugin
or the analyzer that we're using, and as you can see,
Spicy in there.
So now let's go ahead and put it all together and run an independent instance
of Zeek real quick in here just to analyze this http.pcap.
And so with this command we're telling Zeek to run
Zeek using our Spicy HTTP script,
and we're going to run it against this HTTP pcap,
and we're adding in the new HTTP event in there as well.
So we have the pcap, the Spicy analyzer,
the event, and the Zeek script all in this code right here.
And remember,
you can call these inside of actual Zeek scripts as
well to have it run automatically.
But since we're just testing this against this pcap,
we'll be able to see everything in action.
And as Zeek's doing its thing, it's analyzing that pcap,
it's pulling the HTTP information out of the initial header,
and it's actually using the analyzer to create an event
based off of the information that it sees.
And then we should get our print output from the Zeek script.
And as you can see, Zeek saw from our local address a GET request for index.html.
And that was what was in the pcap itself.
And now if I look here, and since we ran the script locally,
outside of the automated Zeek deployment,
we have all of our logs in the local folder that we're in,
or the present working directory that we're in.
That's because we initiated Zeek here.
So we have our conn.log, the http.log, and the packet_filter.log in here.
And so based on that pcap, we have connection events in here that were created,
and we can use the JQ tool as well.
And it looks like I have to fix my JQ tool.
But you can see that we have the conn.log events in here and
then let's look at the http.log events as well.
And you can see that we have information from the pcap,
just based on the information from the HTTP header.
We were able to look at the pre‑created Spicy HTTP analyzer,
we were able to look at the event that we created specifically for that,
and then show you how to use a Zeek script to instantiate Zeek locally
just to look at the pcap and using those Spicy parsers.
Now let's get ready to close out this module and move on to the next one.
All right, that was cool.
The upcoming modules in this course will focus more on
the integration piece with other tools,
but this was a great way to kick off the conversation.
We were able to talk in detail about adding onto Zeek's
capabilities without integrating with other technologies.
We talked about extensions, packages, and projects,
additional add‑on scripts,
and some more of the frameworks that we can use to get more data in or
manipulate the data that we have already coming in.
Now that you have an idea of some of the expanded capabilities of Zeek,
we need to move on and get it integrated with other security tools.
We're going to be spending the next module talking all
about how Zeek is used with Security Onion.
We'll also explore the Security Onion implementation of
Zeek so we can see some specifics around how the data's
used and how the scripts are built.
Join me there.