I am so glad that we were able to see the Intelligence
Framework in action in this module.
We were able to configure Zeek to flag on some basic intelligence information,
as well as configure the JA3 package to give us our
hashes on our secure communications.
We can then feed that into the Intelligence Framework to match on
similarly to how we did with the defendthenet URL.
This course covered quite a bit of content,
so let's take a few minutes to review what we've learned and see some additional
resources that we can use to help solidify this knowledge.
We started out the course by looking at the extensions and a few of the
frameworks that we use to expand the Zeek ecosystem.
We learned about the input framework and how we can ingest data
differently and took a look at how to use Zeek packages here.
Remember, there are a lot of use cases that have these packages prebuilt for,
so check out the Zeek repository if needed for ideas.
We then moved into using Security Onion,
and we had a great module about how Zeek is used within it and what we
can use in order to view and consume the Zeek logs.
This is one of the more popular security operations platforms out there.
After that,
we detailed another use case of ingesting the logs natively into the ELK
stack and then using that information with Arkime.
We used another security platform known as Malcolm in order for us to
see how the Zeek fields are mapped to Arkime's,
how to enrich the data with additional information such as GeoIP
and MAC OUI information, and how to view and pivot to and from the
Zeek logs within Arkime's dashboards.
We detailed the configurations for RockNSM and how it uses Zeek as well,
emphasizing the ECS standard for the logs being passed
over to Logstash and the ELK stack.
We also took a look at how Zeek is able to see and extract entire
files from the network stream in order to either save,
quarantine, or send them off for analysis.
After that, we covered more information about the Zeek
Intelligence Framework and included SSL/TLS fingerprinting
using JA3 into the conversation.
Now that we have that review done, let's close out this course.
Zeek is such a great tool that we can use to help identify
potentially malicious activity on the network and gives us
information to investigate it properly.
Here's some additional resources that you can use in order to
help facilitate your own implementations of Zeek and integrating
it with other tools and products.
Now this is not an all‑inclusive list,
but it should help you get moving in the right direction when it comes to
Zeek integrations and platforms that have it built in especially. As
always, if you have any questions or need clarity,
feel free to reach out. Course ratings and constructive feedback
are always welcomed and very much appreciated.
I take all of the feedback that I receive and actively try
to use it to make my content better.
So please,
if you have time, give my courses that you've seen a rating, and let
me know what you think. On top of this, you can also subscribe to me
as an author here at Pluralsight so you can be notified whenever my
future courses are released.
There are and will be many cybersecurity and cyber operations courses here, at
Pluralsight, so be sure to check out the other ones as well.
I have a lot of courses on Splunk and machine data in general
as do other great authors here, so you can dig down into
learning about the data itself. Now, it's time to close out the course.
I really appreciate you sticking with me throughout the entire
course, and I hope that you've learned something new.
The hope is that you've increased your Zeek knowledge and have leveled
up your skills. Remember, we are community of professionals, and
sharing knowledge is the key to our success.
It helps build up a stronger InfoSec community.
Thanks for viewing this course, and I will see you in the next one.