Welcome back.
In the previous module,
we focused quite a bit on the Elastic Stack and Logstash so that
we could really get a feel for some of the possibilities for
using Zeek in conjunction with it.
We were also able to get Zeek integrated with Arkime to help fill in the
blanks and view the Zeek data right alongside Arkime.
In this module,
we'll continue the Logstash discussion a bit and also introduce RockNSM.
What is RockNSM exactly?
Well, it's a network sensor.
It stands for response operation collection kit.
It's a network security monitoring platform that provides us the ability to
perform threat hunting and incident response operations.
Does this sound familiar?
Well, that's because, in this course, we've already seen something similar,
Security Onion.
Similarly to how Security Onion combines multiple
tools into one integrated platform,
RockNSM gives us the ability to use many different tools as well.
Here's a list of the various tools that come with a standard RockNSM deployment.
We have Zeek of course, along with some other familiar names like Elasticsearch,
Logstash, Kibana, Suricata, and all of these other ones.
Stenographer can also be used for full packet capture, similar to Arkime.
We have Suricata as the firewall and the Elastic Stack for logging,
stashing, and parsing of all the data.
The question that we need to concern ourselves with for this
course and module when it comes to Rock is Zeek.
How does it fit into the picture? Rock deploys Zeek with
somewhat of a standard configuration, which we'll see in the coming demo.
Its logs are sent to the designated log directory,
and we can view them in Kibana.
Zeek provides the protocol analysis in metadata to the RockNSM cluster.
Rock is a passive tool, so Zeek fits right into that as it's passive as well.
I think this diagram says it all about how everything works within Rock.
So let's talk through it a bit.
The NIC is receiving the data of course.
Zeek and Suricata are the main tools processing the information.
And they feed the logs into Kafka,
providing them message queuing and distribution into the ELK stack.
And Google Stenographer is here receiving the raw packets as well,
feeding them into Docket and the file scanning service.
If you need additional information on RockNSM,
visit the website and download it to play around with it and take
a deeper look at how Zeek is implemented here,
as well as how you can level up with some of the other tools that's included.
Here's an example of the local.zeek script that's used in the standard
Rock installation. As you can see, and we'll dive into this a little
bit more in detail, Rock adds a new set of script customizations and
adds the Kafka plugin. These are some of the big differences in this
versus the default Zeek installation that we've seen before. One of the
cool features that I like about this is that the deployment is
templatized,
making it relatively easy to get up and running. Ansible controls a lot of
the initial configuration and the deployment and uses the templates for each
tool to help with the initial configurations.
All right,
let's use the next clip to go into the lab and check out some of the scripts
specific to Rock and how they're used within the system.