Arkime is the other component of the integration that
we're working on in this module.
If you've been around for a while, you may know it as Moloch.
It's an open‑source packet capture and search tool that gives us the
ability to integrate with other tools like Zeek,
utilize APIs, and scale over a clustered deployment.
You may be thinking already,
why doesn't Arkime cover Zeek's use cases, since
it's a full packet capture tool?
Well, in some ways it does,
but it's not typical for us to do full packet captures in every
single instance that we may need information for,
or we may not want to utilize that much storage for the captures.
Zeek does a lot of great analysis on the traffic
already, and so it can fill in the blanks,
so to speak, in the instances where we aren't doing full pcaps.
Okay, then what's this integration actually going to do for us?
We're going to map Zeek's fields with Arkime's schema and enrich the
data so that we can view it and search it in Arkime.
This will give us a one‑stop shop for seeing the data and being
able to correlate both data types during analysis,
which will help us out in our cyber operations.
We'll be able to essentially link Zeek's logs to Arkime's sessions to
view both and get a better idea of what's happening.
Enough of the explanations of the tools and integrations we'll be doing.
Let's talk about what we need to actually get this going.
We need to have our Zeek instance up and running,
we need the ELK Stack installed and receiving the Zeek logs
with Logstash ingesting and stashing them,
and we need Arkime installed and operating smoothly,
or at least operating.
If you need to get an understanding of how to set up Arkime,
then check out the docs here.
Also, if you're interested in learning how it can support network
analysis activities mapped to the MITRE framework,
then check out the blue team tools skill path and,
more specifically, the course, Network Analysis with Arkime by Josh Stroschein.
So here's what we have going on.
We have a platform known as Malcolm, which was developed by the CISA,
or the Cybersecurity and Infrastructure Security Agency, in
partnership with the Idaho National Lab.
And what exactly is this?
Well, it's a platform that also has many different tools in it,
similar to Security Onion,
but much more robust with allowing us to analyze logs and files. What I really
like about this one is that it comes with everything that we need for this use
case built in. We have Arkime installed and running,
we have Zeek installed and running, as well as the ELK Stack.
What we'll do in the next few clips is this. We'll look at the configurations
for the Logstash parses and make any necessary modifications,
we'll grab all of the Arkime field definitions so that we know what to map the
Zeek fields to, we'll actually view the mappings needed,
then enrich the logs for things like GeoIP lookups.
After that, we create the WISE data source in Arkime and validate that we can
see the sessions for both and correlate the network activity between the two.
In the next clip we'll get started with it. If you want to follow along with
your own installation of Malcolm or want to try the mappings with your own
installation of the tools instead, check out these links. They'll at least
get you started, and you can follow along in the lab to view it all inside of
Malcolm.
Since we've already walked through the basic setup of getting the Zeek logs
shipped over to Logstash, you should be able to follow along with your own tool
if you don't want to download the Malcolm platform.