All right,
now it's time to hop into the lab and configure some minor
changes to demonstrate the Salt configurations.
We'll start out by looking at our default
configurations for Zeek with Security Onion.
Then, we'll dive into the local Salt script for Zeek.
Then we'll make some modifications and see that it's working as expected.
Let's get it going.
All right, and here I am in my Security Onion box.
Now remember, Zeek comes packaged as a container within Security Onion.
So a lot of the commands that we're going to be running here and
a lot of things that were going to be doing are different from a
traditional Zeek implementation.
So before we do anything, I want to go ahead and stop Zeek,
and this is the command to do so.
All right, and now that Zeek is stopped,
the first thing that I want to do is go ahead and
look at that default Salt file.
All right, and as you can see, we have quite a few configurations within this.
Looking at the file,
it seems like it's structured similarly to how the Zeek local
script is structured in a typical Zeek installation.
So we have our Zeek control configurations here where we're
defining the MailTo servers and where the logs are going to be
stored and what the local site policy script is.
So we have our local.zeek script here as well.
And then it comes into the local area where it's defining our
loads and what scripts that we want to use,
what frameworks we want to use.
So when Security Onion was building this,
they included a lot of the stuff out of the box that Zeek
traditionally has turned on as well, but they tuned it a little bit differently.
So as you can see, we're using a couple of different frameworks.
We have our protocol inspections turned on,
and we're using one custom signature file as well.
We also are automatically redefining those logs into JSON format
because that's what Security Onion uses for this.
And as you can see, it's in YAML format, so the readability is there.
We have the different sections for the loads,
we have the redefinitions, so on and so forth.
So with each of these sections that are here,
we're essentially modifying just a different piece of the Zeek configuration.
All right, now before we do anything,
what we need to do is we need to copy this default Salt configuration
over to our local Salt folder just to make sure that it doesn't get
overridden if we get an update from Security Onion or anything like that
because this default Salt file will.
Oops, looks like I forgot the sls at the end.
Oh, there it is.
Okay, good.
And since I already have the local file copied over there,
I'm just going to go ahead and override it with this fresh one
from the default configuration, and now let's go hop over there
and nano it so we can edit it.
All right, and now that we're in here,
there's two things that I want to specifically change
just to test out the functionality of the Salt
configurations and everything like that.
So what I'm going to change is I'm going to change the log
directory real quick from nsm/zeek/logs to just my home
folder as the joeabrah user.
And then the second thing I'm going to do is just load a simple Telnet script
so we can see if we can generate some alerts and just validate that everything
is working and the logs are going into our home directory. Now keep in mind,
the Security Onion workflows and the processes do depend on a lot of these
logs and the locations of them.
So if you're going to change this information,
just make sure that you understand how Security Onion is using the
data and map it to the new location correctly.
And then the other thing is going to be in the load‑sigs section, we're going
to add another signature in here, and the signature is just going to be a
simple Telnet script to detect Telnet activity.
And just for your awareness,
here's that Telnet sig. It's the same Telnet signature that we used in
my previous course, Writing Zeek Rules and Scripts. And with that
completed, we can go ahead and start Zeek again.
All right, and as you can see, Zeek started successfully.
It shows that we changed our configuration.
It did a little diff for us so we can tell us what the new configuration
contained. And as you can see right here, we have that we subtracted the log
directory being nsm/zeek/logs, and we added our home directory as the new
logging location. And then scrolling down a little bit more in the local.zeek
file, we have our loaded telnet.sig file as well for the signature. And if
you look right here, it shows the location of the local.zeek file.
Let's hop in there and see if we can actually see it in
the container itself. And look at that.
We have our actual local.zeek file with all of the traditional load
statements and everything like that in there.
And as you can see, our telnet.sig was added to it right here.