We're going to be using this demo to go over the RockNSM configs for Zeek,
see some of the visualizations and configurations in Kibana,
and see what differences are included in this setup to give it the
ability to interact with other tools in this setup.
Let's hop in and get started.
All right, and here we are in our lab ready to go.
I'm logged into my Zeek box,
but what I need to do is just go ahead and open a connection into my
RockNSM box so we can go ahead and look at that.
All right, and here we are.
So a couple important things to note about RockNSM is that the most
recent version is build 2.6 as of this recording.
Not too much has gone on on the development side,
at least publicly on the web page anyway,
but the package is still there.
The tools are still interacting with each other and work.
But like I said, the most recent version is 2.6, and it's there.
They've upgraded to Zeek 3.0,
and a lot of the tools are included in this package automatically.
You can go through the installation of the tool.
It's fairly straightforward.
The instructions that are provided on Rock's website are clear and provide
you a step‑by‑step process, and you can go ahead and turn on or off
different tools if you need them or don't need them.
But remember, with a lot of these platforms,
you can help develop the tools or experiment with them to get it working for
your specific use cases or your specific environments.
If you are following along or intending on downloading RockNSM
to try to see if it can work in your environment or see if it
would benefit your organization, go ahead and download it.
It's free. And then you can spin it up in a virtual machine or put it on
a hardware box and just dive into the configurations,
see the functionality of it, see the use cases,
and validate that it can suit your needs.
So before we get into the actual configurations in the CLI,
I'm going to jump into Kibana so we can talk through some of
the index patterns and stuff like that.
So what RockNSM is doing for us is it's standardizing a
lot of our indexes and our logs so that a lot of the tools
can all use the information.
This is a little bit similar to Malcolm,
like we saw in the previous module,
that platform where we were mutating a lot of the Zeek fields to map to Arkime
and then also to be able to be used in other situations as well or other tools
inside of Malcolm. And this is a similar case.
So RockNSM implements the ECS standard for the logging.
So as you can see, we have our ecs‑ as the prefix for the indices here or the
index patterns here. And if we're looking then at these index patterns in
Kibana, we can see that we have Zeek index patterns,
we have Suricata index patterns. And then if we wanted to create more based
off of some of the other indices, we could. If we hop over Index Management,
we can see all of our different indices here.
We have the file analysis index. We have different indices for Zeek
and, like I said, Suricata as well. And each Zeek index is here for a
specific use case or specific reason.
So for example, we have a detection index here. We have
observation indexes. We have file indexes as well.
So each one of these is for a different use of Zeek's logs.
I also wanted to show you some of the sample dashboards that come with
RockNSM. There's a whole bunch more, but some of these are good at gauging
metrics for the system and validating that it's operational and that it's
actually capturing traffic and so on and so forth.
So this first one is just a simple dashboard that comes with it. It's
source versus destination bytes over time. And it just gives us a nice
little chart here, and then we can switch the visualizations if we wanted
to gauge or table or just seeing the metrics.
So this is a pretty decent dashboard for us to be able to use for metrics
at least. We also have record counts for Zeek as well.
So we're able to view this visualization and see the
cumulative sum of the record count.
So this is all about the underlying system and how Zeek processes it.
And then we also have Suricata logs and the alerts over time.
So here we have a couple spikes for actual alerts.
And this is the lab environment,
so it's not going to generate a whole bunch of alerts out of the box.
And what's really cool about all of the tools being included in here,
similarly to Malcolm and other platforms like Security Onion,
is that we can use a lot of this information collectively
between the tools. So we can pivot from Zeek logs and go
investigate the event that occurred, see if Suricata saw anything or vice versa.
If we get an alert in Suricata,
we can go look at the actual connection logs in Zeek and so on and so forth.