Throughout this course,
we're going to be getting started with Zeek in many different ways.
We're going to start with an introduction to Zeek and talk about its features,
benefits, use cases, and a little bit of history of it.
We'll then talk about using Zeek in the enterprise as we detail the
installation of it and go through the functionality of the engine and the
ways to configure and control the application.
We'll be just using a basic configuration for this course's scope.
After,
we're going to discuss the components of Zeek and detail the many frameworks,
subcomponents, and plugins for it.
We're trying to learn all about its many capabilities.
Then,
we want to go over the language of Zeek and talk about the scripting
capabilities and especially cover the signature framework.
Finally,
we'll wrap up the module and cover the outputs and reporting
capabilities of Zeek so you know where to find what you're looking
for and be able to analyze the information.
There really aren't any prerequisites for this course except to have a decent
understanding of devices on the network and network protocols.
I also would like you to have a really big desire to learn all about this tool,
but since you're watching the course, it looks like you already have that.
If you want to follow along with us in the labs throughout the course,
you can use most major Linux platforms to install and run Zeek on.
I'm using CentOS 7,
but any capable operating system would work as long
as it's compatible with Zeek.
You'll also need to download Zeek from their website and have at least
something on the network for it to capture traffic from to analyze.
Like you saw in the topology earlier, I have a few devices for this purpose.
Other than those things, you should be good to go and follow along in the demos.