We're back.
We've learned a lot about the network monitoring tool,
Zeek, throughout this course, but we still have a little bit to go.
In this module,
we'll be reviewing the previous modules and discussing some
output options that we have available within Zeek.
Let's get started.
Here,
we are going to start out by talking about some of the important
points to remember from our previous modules.
Then,
we'll get into the output discussion and learn about some of the
logging and alerting that we can do with Zeek.
Finally,
we'll wrap up the course and send you off to continue practicing with Zeek
and learning more about its functionality and capabilities.
To learn any new technology or tool,
you must first learn the basics about what it is and what it does.
Zeek is a network monitoring tool that can be used for many
different purposes and uses an event-driven approach to detecting
anomalies or threats within the network.
It's also very good at monitoring network statistics to give the
ability to troubleshoot portions of the network too.
Zeek's primary means of detection and analysis is through the
use of scripts that can be either predefined or customized to
fit your environment's needs.
The way the engine works is that you have it analyze the network traffic,
generate events, and use scripts to interpret those events.
Some sort of action is then taken on those events based
on what's defined in the scripts.
We also talked a lot about deploying Zeek in the
enterprise environments and in our labs.
We learned a lot about the standalone and cluster deployments and
discussed the benefits and deficiencies of each.
During this module,
I showed you the installation and initial configuration of Zeek and
demonstrated the component called ZeekControl that allows us to manage
the deployment through an interactive shell.
It's a really handy way to manage clusters especially.
We then went into detail about the various components within Zeek
and learned all about the various frameworks,
subcomponents, and plugin capabilities that Zeek provides.
We detailed a few of these specifically in the module and learned about how
they all fit into the Zeek ecosystem to allow it to function.
There are a lot of frameworks and components to Zeek,
so digging into them a little more would benefit you quite a bit.
Each framework allows us to add some sort of functionality into the tool,
from signature analysis to the logging capabilities.
Plugins also allow us to expand the Zeek capabilities through APIs and custom
code so that we can add to it without changing the base code.
Finally, we learned all about Zeek's language and scripting,
detailing how it works.
We also discussed some signature rules and demonstrated the
functionality of those by analyzing a pcap.
Within this learning objective, we talked about the scripts,
about what you would like to see in your environment,
as well as had a discussion on custom scripting that we can do with the tool.
This allows us to use Zeek in unique ways on a per-deployment basis,
and also help us expand the functionality of it.
Coming up next,
we're going to discuss the various outputs that we have with Zeek.