So the big question of the day is, what exactly is Zeek?
Some of you may have an idea and have used it before, some of you may have not.
We're going to learn all about it right now, so don't worry.
Remember,
the short version is that Zeek is a network monitoring
platform that's used mostly for network security,
but does really well at traffic analysis as well.
Zeek was initially developed in the 1990s and was very
well known under the name of Bro.
1995 is when Vern Paxson began working on the code and started
laying out the foundation for this tool.
Of course, over time it's evolved tremendously,
adding features and protocols and added functionality to the tool.
In 2003, after several contributors helped add to the project,
the National Science Foundation helped by supporting
more research and development into Bro.
Academic research projects were the main contributing
factors to the capabilities that it now has.
After several more years of additions and many adoptions
to the product and the environments, Bro was renamed to Zeek.
We're currently using version 3.0.
So Zeek uses scripts as its main policy engine.
We're definitely going to cover these much more later on in the course.
There are many, many signatures and rules within the Zeek tool that come default,
and you can build your own as well.
You can tell Zeek exactly what you want to look for
and how you want to classify it.
So Zeek can be installed as a standalone or as a cluster and can
perform analysis either in real time or offline.
This is very helpful so that we can perform forensics after the fact and
see what Bro saw or should have seen historically.
It's also a completely passive tool, which is very nice.
I love working with passive tools because we don't have to worry
about the pressure of disrupting the network.
During the operation of Zeek,
it looks for many different aspects of your network for analysis
including protocol behavior from application layer protocols,
file content, and it even decapsulates tunnels for analysis.
The standard output for Zeek is its ASCII logs.
These logs show all of the signature hits that Zeek has and
can be exported to a SIM such as Splunk.
It also has the capability to export using JSON and other formats,
which is really useful for ingesting into more sophisticated
applications in SIMs that can parse the information better.
This type of method allows for a much easier time
reading and understanding the logs.
Another really cool feature of Zeek is its ability to trigger
external processes from within the scripting language.
Configuring this is outside of the scope of this course,
but it can be done from within the scripting language if you're interested.