Now we're going to talk briefly about script customization.
You can get way down into the weeds with regards to
customizing the scripts that we have available,
and much of that is going to be saved for a future
course that's dedicated just to this,
but let's cover it briefly so you know the capabilities.
So,
customizing Zeek scripts can be a difficult process if you
have no experience in script writing.
The scripting language within Zeek uses a combination of operators,
types, attributes, declarations, statements,
and directives.
Using these different parameters,
you can create your own scripts that use events or other
packages to figure out what's going on.
Using these,
you can use the Zeek notice framework or logging
framework to define an action to take.
All of these parameters have specific variable sets that you can use to
configure them properly and provide the flexibility that you need to
define any event or set of events that you want to.
The key thing to writing your own scripts with Zeek is
that it uses the event handlers to come up with the data
that it's using for processing.
Zeek is essentially using scripts to make decisions based
on the information provided in events.
To understand the custom scripts, or any of Zeek scripts for that matter,
require you to understand the events and event
handlers that Zeek collects and creates.
A lot of what Zeek does relies on the context of the packets or data streams,
not just the packets themselves or the fact that they exist.
Zeek is really good at analyzing the back and forth
conversations between two hosts, and that plays a part in your script building.
Once you understand the scripts, whether custom or default,
and the structures of them,
then you can also understand and create logging scripts.
Previously,
we were discussing scripts in relation to the analysis of
network activity in the processing of events.
You can also customize the logging that you do with Zeek
based on the events and the analysis.
We'll cover the various output options in the next module,
but just remember that using scripts,
you can do things like change the logging format from ASCII to JSON,
or any other format, as well as your own custom format if desired.
You can define the output to correspond to your
chosen tool and format as needed.