Before we hop into the lab and check out a few of the
scripts that Zeek comes with by default,
we need to talk about and detail them really quickly.
There are several that are loaded by default,
and it's not recommended that you alter these ones
unless you know what you're doing.
If desired, you could duplicate them and modify them, or just turn them off.
There are two places by default where scripts typically belong
and they're intended for specific purposes.
Unless you tell Zeek to do a bare bone installation,
all of the default scripts are loaded into the base directory.
Anything in the policy directory are customizations and will
have options on whether or not to use them.
We're going to focus solely on the default scripts in the
base directory during this demo and course,
as it's just a getting started course and there's going to
be a more advanced scripting and customization course in
the future at Pluralsight.
In this demo,
we're going to check out the Zeek installation that we conducted in a
previous module and see the base scripts in detail.
First,
we'll explore that base directory within Zeek so that
we can see what we have available.
Then,
we'll break down a sample script so we can understand a
little bit about its functionality.
If you're ready to hop in there and do it, so am I.
Let's check out what Zeek is giving us.
The first thing that I want to do before looking at any scripts
within Zeek is look at the local configuration file.
This is the file that we use to load Zeek scripts and
signatures within this local Zeek instance,
and can be used to add custom ones to the capabilities of the tool.
It's in the opt/zeek/share/zeek site folder,
and that typical default installation should be the only item in there.
Pulling it up to view,
it has a lot of things standard in it that we can use the pound
sign to activate or deactivate within it.
There are a lot of default scripts that we can have it load for us
that help us learn more about the environment.
We have quite a bit of protocol-related scripts loaded by default,
as well as some asset tracking information and SSL certificate analyzers.
We see we have some frameworks activated for looking at different files,
as well as some not activated dealing with layer 2.
This file is where we go to add or remove the scripts,
so we need to be sure we always know where it is.
Moving on,
let's go through and check out the base folder so we can see what
some of the scripting options are by default.
Within this main folder, we have some options here to choose from.
The first one that we're going to check out is the frameworks folder.
As you can see,
this is where all of the different frameworks that we talked
about earlier on in the course are located with regards to
the scripts and configurations.
Let's check out the inputs really quickly to see what we have in there.
Looking at our main.zeek file within this particular frameworks folder,
I can see the script.
Do you see how this language kind of feels familiar,
especially if you're used to programming?
Here,
we can add or remove inputs that we have and modify
how the script can process it all.
We'll be covering the scripting for Zeek in great detail
in a later course here at Pluralsight,
so let's move on and explore a little bit more.
Now let's go hop into the protocols folder and see what we have.
There are scripts for a lot of the main protocols and
services that we see throughout our networks.
I'm going to check out the HTTP one and show you a
little bit about what's in here.
As you can see, we have our scripts, which are designated by the .zeek format.
We also have a signature in here too that comes default,
known as the dynamic protocol detection.
This allows us to enable different analyzers based on
the information that we receive.
So for this one, for example,
if in the payloads we see any of these fields and the protocol is TCP,
and all of this other criteria match,
then we're going to activate the HTTP analyzer to look at it more in detail.
This is that enable action that I was talking about earlier.
This allows us to save on resources,
so we don't have to have all of the analyzers running it all of the time.
Using the signature,
we're invoking the enable action to turn on this
particular analyzer and look at the data.
Looking at the main.zeek script within this protocol,
there's a lot of information here.
We're defining many different fields and structures of the
events and messages that are generated,
so we can accurately determine what's going on.
You can also define the HTTP methods for example, as well.
As you can see,
this one script defines almost all of the variables that are
possible with the HTTP protocol so that Zeek knows what to
look for and where to look for it.
Each function is a different event or different task within Zeek.
For example, looking at this one,
we're telling it to utilize this information here to track a new connection.
We want things like the time, the IDs, and the HTTP state.
Within the base directory folder, go through and explore some of these scripts.
Some of them tell Zeek how to handle different frameworks and protocols,
some help us determine how to handle our events and logs as well.
This entire folder, by default,
is included in the Zeek installation and can help you get a
feel for how your network is functioning.