Now we're going to hop in the lab and see the
installed tool along with its logs.
We'll see the end state with the default configuration
and the default scripts running.
The logs and outputs are just the standard ones,
and they're getting piped over to Splunk via Syslog.
Of course, much more configuration and tuning is needed,
but it's outside of the scope of this course since
we're just trying to get started.
You'll be installing and configuring this all in the next module.
Before we hop in and explore this instance,
I wanted to share this amazing resource with you.
The Zeek Documentation Library, along with its community,
are great for learning more about the program and its operations,
as well as how to tune and script it in more advanced ways.
Let's go explore really quickly.
So here we are in my lab environment,
and I'm logged into the CentOS 7 box that we're using for Zeek.
I'm currently logged in as the user Zeek,
which we'll go through and create later on in the course as
we go through the installation of it.
This box has Zeek fully installed and operational,
which is the end state after we finish the course for you.
So the default installation directory is /opt/zeek,
and that's where we currently are.
The specific directory of logs/current is where we'll go to see our
system in operation and see the events that have flags.
Doing an ip add command,
we're using ens192 for our management and the two others for monitoring.
I have them on the same subnet and VLAN,
so they're both getting the exact same traffic.
But if you wanted to,
you can have them monitor separate VLANs or networks
to see your whole environment.
Going here to the path /etc folder, we have our configuration files for Zeek.
The node.cfg is the one that we'll be messing with during the installation.
Opening it up,
here is where our interfaces are defined in both the standalone
and clustered configurations and we tell Zeek what interfaces to
use for what and how to use them.
Now I'm going into the logs folder so we can see what we have going on.
Listing the contents,
we have a whole bunch of logs that are being labeled intelligently
based on the events and their classifications.
Let's look at some of these really quickly.
Seeing the DHCP log,
we have a lot of information based on the Windows 10
machine getting an IP address lease.
It shows us the specifics of the DHCP requests.
So because of this,
we know our Zeek application is configured and turned on
and is actually monitoring the network.
I also have these logs piped over to Splunk so that we can
see the data a little bit more visually.
Let's go ahead and search for this host, which is the 30.8 IP address.
As you can see here, we have our data coming in.
There are a lot of different source types that we can see
just like in the logs folder on Zeek.
I have it sending everything in that log folder over to
Splunk so that we can see it all.
We'll look at the weird.log events here,
and as you can see, we have some weird traffic from the hosts.
This is one of the cool logs in my opinion because it shows
us the stuff that just doesn't make sense.
It shows us the strange activity, hence the name weird.
Let's look at another one of these log sources really
quickly before we wrap up the demo.
Here,
we can see the DNS traffic going back and forth and see the
information about the DNS requests and replies.
We'll learn how to ingest other formats besides the
typical Syslog later on in the course.
Zeek's able to send the data in other formats besides just
Syslog like we talked about earlier,
and taking advantage of those is extremely useful.
As you can see,
the plain Syslog format just isn't very well structured to be
able to quickly look and identify problems.
We're definitely wanting to make this easier on our analysts.
So there you have it.
We just saw our lab environment and learned all about the basics of Zeek.
In this module, we started out by talking about the course and what it's about,
as well as some of the prerequisite information.
We then discussed what exactly Zeek is and what we can do with it.
After,
we hopped into the lab and explored Zeek as it is after a
default installation and saw some of the logs being
generated and sent over to Splunk.
In the coming modules,
we're going to dig much more into Zeek and its capabilities,
as well as the installation, components,
and languages.
Join me in the next module so we can get our learn on.