Okay,
so we just went through and checked out some default scripts that Zeek uses,
and also showed you how to utilize that signature framework.
That was a really informative demo, wasn't it?
But my question for you is,
how do you know if you should use all of those defaults and what
other scripts and signatures you should use?
Well, let's talk about that for a few minutes.
One thing I always tell customers is that you have to know,
at least a little bit, what you want to look for when looking for it.
Are you looking for a network monitoring solution to look at
statistics or are you trying to detect threats?
Or is it both?
The Globomantics requirement is to use this as a network monitoring solution,
not specifically a network security solution.
So it's safe to assume that we'll want things like
the capstats component running,
as well as protection against any misconfigurations
in the network and anomalies.
Now this kind of straddles the line between network monitoring and security,
but that's okay.
In today's world, they sort of go hand in hand.
Misconfigurations can lead to compromises,
and compromises can lead to weird traffic in your network.
So what do you want to see with this tool?
This is a long discussion to be had as you're going through and
looking at the default scripts that Zeek comes with.
At the very least,
we would want those default scripts to be turned on and
functioning at first so we can be sure we're monitoring most of
the things that we can't even think of yet.
When having this discussion with your team or thinking out loud to yourself,
the conversation has to answer a few questions.
Besides what do you want to see,
we have to ask what's my network supposed to be doing?
What's the normal protocol behavior look like?
Should we be transferring files between hosts?
What about interface utilization?
Link saturation?
Should we be worried about weird activity or just look for
events that relate to network functionality?
All of these need to be asked so that you can write either
scripts or signatures to look for to find that information
and use Zeek effectively.
Tuning is a word that some people despise.
It's something that we need to do though,
typically on a recurring basis for almost all security and analysis tools.
Our IDSs need to be tuned, our IPSs need to be tuned, firewalls too.
With Zeek, this is especially crucial.
Think about the use cases you have in your environment.
Are you actually detecting the anomalies or is Zeek just ignoring them?
Or,
is Zeek doing too good of a job and generating false positives for
events because some things are just to generic?
As you test the functionality of Zeek after deciding your use
cases and writing scripts and signatures,
you need to tune the system.
This can encompass turning unnecessary scripts off,
adding new ones, or modifying existing ones.
We want your environment to find what you're looking
for and do so in an efficient manner.