if you've taken other Zeek courses or have used it before,
you should be familiar with Zeek and how it operates and have
some knowledge about the scripts within it.
We'll expand on all of that information throughout this course.
In this module,
we'll focus on getting acclimated with the integration capabilities.
Up first is finding out what exactly we can do with integrations and Zeek.
We can use some of Zeek's frameworks to pull in additional data
and manipulate it or use it in various ways.
The input, configuration, and NetControl frameworks
come to mind from that perspective.
Now, these may not be directly involved in integrating with other products,
but they help us find additional use cases for our data.
The input framework helps us read data from sources into
Zeek, and we can use that to read data into tables or
actual events for Zeek to use.
The configuration framework is our alternative to using some
constants in the scripts and gives us the ability to change any
of the configurations at runtime.
Think of this as our options for running Zeek when we need a
different configuration or tweaks without having to go in and
modify the scripts themselves.
This is useful if we want to turn on or off certain features or scripts to test.
The NetControl framework is the cool one of the bunch that
actually helps us with the integrations instead of just
adding functionality to Zeek itself.
This framework is Zeek's API, where we can connect it to external devices.
Think of this as our way of passing the rules that we want to pass to
our network devices after we detect certain behavior.
We can use it to create and send rules to our
routers and switches and firewalls.
We'll talk about the Intelligence framework later on as an additional
way to get that specific information in. Other than the frameworks,
though, we have extensions that Zeek can use to integrate with other
technologies or add uses to it.
These extensions can be through packages,
custom scripts or tools, and through Zeek projects and add‑ons. We'll talk
about packages in the next clip, so we'll focus on the projects and scripts
that we can add for the remainder of this one.
So, the projects are bigger things that you can add on to Zeek.
We'll be talking about Spicy and the other ones a little bit
later on, but think of the larger add‑ons as projects. They're
the big extensions that we can see on the GitHub repo. Extra
scripts can be added as well.
I know we talked a lot about scripting in the Writing Zeek Rules and
Scripts course, so we'll just highlight it here.
We can add external scripts from third parties or from Zeek or create our own.
Now, the cool thing is that these script extensions are found all over the web.
Some of the ones that the Zeek team supports is on their GitHub
page here with some of their bigger projects.
All of these extension scripts and cool functionality like
getting us NIC stats or parsing JSON quickly.