Welcome back to the course, and welcome to the final module.
We spent the entire course so far talking about how
Zeek can integrate with other tools,
how it's used in combined platforms, and how to use some of its more
hidden capabilities like file carving. In this module,
the focus is on intelligence.
Zeek's Intelligence Framework is designed to consume data
and make it available for matching.
It's a handy framework that we can use for both static
intelligence and dynamically downloaded intelligence.
The intel that we use can be something static in
nature like a domain, IP address,
email address, or something else that can be used to
identify something or someone.
Those static intelligence items could contain additional
context or metadata that we can use.
Take an IP address, for example. Using something like the GeoIP database
that we saw in a previous module, we can stitch the location information
about the IP address and even look up who the owners are and if the IPs are
part of any malicious domain. All of that info is additional context data
that we can use to help us detect threats or match specific criteria that
we're looking for.
As I've mentioned previously,
we can create an alert if our outside traffic is going to something like
another country that we may not want it to be communicating with.
Another use of this is hashing. We have the File Analysis Framework that we
talked about earlier and JA3 data that we'll cover later on in this module that
we can use for matching traffic to potential threats.
We can take the file hashes and the file analysis that Zeek does and
attempt to match them to known malicious files.
We can use the JA3 data from the SSL and TLS connections to identify
potentially malicious data streams that are encrypted, matching them
to known JA3 hashes. More on that later.
The Zeek Intelligence Framework is relatively simple to get started with.
We can take a basic intelligence file or, as I mentioned, we can
download our own dynamic intelligence data and format it to align with
Zeek's framework. Then, load the intel framework and match the traffic
that we see to that intelligence.
The data that matches can be flagged in the intel log, or we can raise a
notice or webhook or any of Zeek's other actions that we have available to us
to use. With the Intelligence Framework, we have this list of intel types that
we can match on in our intelligence file.
We have things like the email address, IP address,
software names,
file hashes, domain names, URLs, usernames, and
certificate hashes to name a few.
Each of these gives us different matching abilities that gives us some pretty
cool flexibility within Zeek. Now I'm not going to go through and read each
function and type and event that we have available to us, but you can find
more information about the framework at this link. We have three functions for
intelligence built in, seen,
insert, and remove. And we have a few events and hooks here as well.
What I really like about the Intelligence Framework is the ability to create
more complex matches using the functions and events and variables that we have.
Similar to the rest of Zeek's scripts, we can make the intelligence handling as
simple or as complex as we need it to be.
My philosophy is that as long as it's used effectively,
context and metadata is very important to have. Let's check out how to
configure the intel framework with a simple matching item.