If you work in the information security space,
then you understand the challenges we face defending networks against attacks.
Zeek is a network security monitoring tool that,
if used effectively,
can help defenders rapidly identify malicious cyber activity.
My name is Michael Edie, and in this module,
I will teach you how to design a Zeek deployment for enterprise monitoring.
Globomantics needs a network security monitoring solution, and Zeek was adopted.
However,
now the software needs to be deployed and integrated with
the company's existent elastic stack that is already
collecting security event logs.
In this clip.
I will teach you how to configure a Zeek management host that will be the
central location for the Zeek cluster configuration.
The management host is where all the configurations,
logs, and private SSH authentication keys are stored.
You will need a dedicated server or virtual machine that meets the
specifications for your network. On the Zeek management host,
you will need to ensure Zeek is installed.
I will not be covering how to install Zeek; however,
you can refer to the Getting Started with Zeek course for how to install Zeek.
Once Zeek is installed on the management host,
a user account needs to be created that will manage the remote sensors,
also called workers.
This account must be the same name on the management host and all
other systems that are part of the Zeek cluster.
The user that we created in the previous step must be used to generate SSH
public and private keys for authentication across the cluster.
Once these steps are complete,
the Zeek configuration needs to be modified to reflect a shift from
the default standalone to a cluster configuration.
These are the steps necessary to get a Zeek management host prepared.
We will take a look at a demo in the next clip.