Welcome back to the course.
We've covered a lot of information so far, and we still have a lot to cover.
This module is all about the Zeek language and how to
utilize the signature framework to make Zeek work for you
in the ways that you want it to.
We're going to cover a lot of information in this one, so get ready.
In this module,
we'll talk about the Zeek language and how it works with the
tool to help get what you need out of it.
We're going to start by talking about the signature framework in detail and
learn about how it interacts with the different analyzers and other tools to
get specific information from the traffic that's seen.
Then,
we'll detail the default scripts that come with the Zeek application and hop
into the lab to look at how some of them are structured.
After that,
we'll need to talk about what information you want to see in your
environment and how you can utilize Zeek to see that.
Then,
we'll briefly cover the customization of Zeek scripts and the
capabilities that this ability provides us.
We'll wrap up the learning after that and get into the next module.
When talking about Zeek's language,
it's important to understand that it's fairly similar to Python and Perl.
Its ability to be customizable and extensible enables users to
use Zeek how they see fit and is fairly non-restrictive with the
capabilities that Zeek provides.
The language is a Turing-complete scripting language that works in
conjunction with analyzers to complete tasks.
What's cool about Zeek is that all of the analysis
is not hard coded into the tool.
You can add or remove analyzers and scripts as you want to
ensure that you have a fully customizable tool for network
monitoring and security tasks.
The nice thing about Zeek is that it uses a combination of
signature analysis and behavior analysis,
as well as a few other unique detection models,
to find malicious or questionable activity.
This is great because it can directly compete with
some of its higher-cost competitors,
most of which use the hard coded scripts to detect threats.
The fact that you can add or remove capabilities in a modular
way because of the scripting capabilities gives many
organizations a great detection tool.
This tool can have a few different inputs as mentioned and can be used to just
simply sniff the network traffic too using its interfaces.
As I mentioned before,
the language that Zeek uses is a Turing-complete scripting model.
This is based off of an event-driven model.
What this means is that the events that Zeek detects are neither good nor bad,
until the scripts that we apply to the tool tell us.
A good example of this would be a device in our network that reaches
out to a DNS server that's not in our network.
Depending on how we write the script,
that particular event could be bad and generate a logger alert,
or it could be ignored because we think it's okay.
This gives us the ability to really flag what we want
and not just what the box tells us to.
Let's talk about the signature framework so that we
can learn how these scripts work.