In this demo,
we're going to configure the Intelligence Framework to match on a URL.
We'll use pluralsight.com, for example.
Now in this demo, we're just going to use basic URL matching,
and we'll be loading the Intel seen script to help with the handling.
We'll look at some of those scripts first,
then go in and configure ours and test it out to make sure that
we get the data populated in the Intel log.
Let's hop in.
All right,
and here we are in our lab environment or in the same
Zeek box that we've been working in.
And the first thing that I want to do is go ahead and just check
out some of the Intel scripts that we have.
And as I mentioned,
we're going to look at the seen directory and see what we have here.
And as you can see, there's a couple scripts in here.
And the first one that I want to show is going to be the
connection‑established.zeek script.
It's a pretty simple script,
pretty much just identifying the connection being established and
ensuring that the TCP connection is established so that we can
pass the connection information over.
Let's go ahead and check out another one like the dns.zeek, for example.
Now if you look at this one,
we're doing a similar function where we're looking for a query and
looking for a specific domain that we would put in our intelligence
file that we might not want our users to go to.
This is going to be similar to the URL matching that we'll do in this demo.
And finally, let's do the http‑headers one.
Now this one's a little bit bigger because we're looking for a little
bit more specific information about the HTTP requests.
And as you can see,
we have some matching statements in the Intel seen indicator value here.
So we're looking inside the header.
We're looking at URLs.
So this is going to be similar to what we're going to be using in this
demo here since we're going to be using the URL matching.
And if you're familiar with Zeek scripting,
a lot of the syntax looks familiar with the exception of the
actual Intel events and functions and the options and
variables that are involved in it, like the indicators and stuff like that.
And what's really cool is if you look here,
because we're analyzing HTTP packets for example,
we're able to use the user agent as a matching type as well.
So if we didn't want users connecting with Firefox for example,
we could go ahead and create an intelligence indicator in our intelligence
files and use this script to be able to match on it.
So let's go in, and let's create our test file.
I'm going to hop over to my intelligence folder here in my Zeek home directory,
and I'm just going to create a file called globo_intel.txt.
So here,
what we need to do is we need to make sure that our Intel file is tab‑delimited,
and we have to make sure that we have the field values at the top.
Now, if you remember from the Zeek script that we just saw,
we have a couple of these here.
We have the indicators and the indicator types similarly to what we
saw in the scripts and what they're looking for.
And remember, these have to be tab‑delimited.
So after each field, we have to make sure that we press that Tab key.
Now for the indicator and indicator_type,
we have those designated as pluralsight.com and Intel URL.
So what we're doing is we're looking for a URL intelligence,
and the indicator itself is anybody going to pluralsight.com,
for example.
Now the meta source and the meta description,
you can customize these however you want to in your environment.
I'm just throwing these up here just to show some of the
capabilities and the value that we can do.
So let's go ahead and save this file and exit.
And then,
the last thing that we need to do before we can test it
out is to modify our local.zeek file.
And what I'm going to do is I'm going to skip all the way down
to the bottom in my custom script section,
and I'm going to go ahead and load the Intel seen framework.
So I'm going to load all of those scripts that we saw in that intel/seen folder.
And then,
one more thing that I have to do is I have to create a redefinition statement in
here telling Zeek where to read my intelligence file from.
All right, and this is how it's supposed to be.
We're calling the Intel read_files function and designating the
directory and the file itself that we just had.
So it's that globo_intel file.
Now what you could also do is create a custom Zeek script
where you're only calling that script in here,
and you're loading the framework that you want and having all these
redefinition statements in the script itself instead of having to
list them all in this local script.
That's fine as well.
Either way, this has to be defined though.
So let's go ahead and save this, and let's go ahead and deploy Zeek.
All right, now that Zeek is redeployed with our new configurations,
we need to generate that traffic.
So what we're going to do is we're going to hop over to our domain controller,
and we're going to navigate to pluralsight.com.
Now just us navigating to this initial website should prompt
the Intelligence Framework to spring into action and give us
some information in the Intel log.
So let's go look at it now.
All right, and as you can see, after a couple refreshes of the log directory,
we don't have anything in here.
So let's go ahead and modify our Intel file again,
and let's try to do something different.
And I'm pretty sure I know what my mistake was
because I'm trying to use a domain.
So let's go ahead and do the domain and use the DNS requests that are
getting sent across to be able to match on the Intel.
So let's redeploy Zeek again,
and then we'll go through and make sure that our
host sends that DNS request again.
Before we do so, we need to make sure that we go ahead and flush our DNS.
All right, now that we've flushed our DNS cache,
let's try to go to pluralsight.com again.
Let's go ahead and try one more website and see if that can work.
I think I'm having some DNS issues in my environment.
So we're going to go ahead and try going to defendthenet.com instead
since we haven't been there in our virtual machine yet,
so it should send a DNS request.
And here we are.
And as you can see now, we have that intel.log.
And when we go ahead and cat it with jq,
as you can see here, we have our indicators.
We have our seen indicator type, which is Intel DOMAIN.
Where did we see it?
We saw in the host header.
So do you remember that HTTP script that we saw in the Intel seen
folder that had the in‑host header statements in there?
We saw it on Zeek.
We have the IP address information, we have the port information,
the timestamps, and everything.
And then when we look at the matched type,
we have the Intel DOMAIN again,
and we have the test‑intel‑website that we labeled in
our text file as the meta source, so that's why it's showing up as sources here.
So that's using the Zeek Intelligence Framework to match on going to a
specific domain using this simple text file that we created.
Now you can get a lot more robust with how you create these
indicators or how you use the indicators.
And remember,
you can always download other intelligence files and use those in here as well.
So the capabilities can support many different use cases,
and you can likely suit the Intelligence Framework to meet
your specific needs in your environment.