That was a really great module.
We were able to talk a little bit about how Zeek is implemented within Security
Onion and validate that the tools are operating as expected.
A few important things to note about this integration are that Zeek is
in a container within the Security Onion platform,
that it uses Salt, which is a YAML‑based config,
and that we can use both Hunt and Kibana to view the information.
Zeek still has the same functionality here as a standard deployment.
But with it being already integrated into the Security Onion suite,
it can be used more easily in cyber operations seamlessly
with the complementary tools in the suite.
Don't forget to customize it to suit your environment too.
And remember,
you can do those pivots into the case management and
looking at the PCAPs and so on and so forth.
So it's a really robust tool,
and I encourage you to download and use it if you're interested in
seeing how all of those tools interact with each other.
Before we move on and get further down this ELK stack rabbit hole,
if you need additional information about the Zeek
integration with Security Onion, you can find it here in the docs.
It'll take you deeper into the Salt configurations and
how Zeek interacts with Security Onion.
Since it's a free image to download and use,
you can read through those docs and practice with that lab version.
That way,
you can experiment with ideas that you see in the docs or with
new features that you're trying to implement or new
integrations into the tool. Coming up next,
we need to detail Elasticsearch and Filebeat a little bit more and also
talk about how we can use Logstash to enrich the logs,
mapping them to Arkima schema.
It's going to be a lot of information, but it'll be fun.
Join me in the next module.