Zeek

https://docs.zeek.org/en/current
Admin
Zeek is a network analysis framework that processes network traffic for security monitoring, threat...
Tokens:3,001,728
Snippets:52,299
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Hello World in Zeek JavaScript

Source: https://docs.zeek.org/en/current/tutorial/scripting/index.html

A basic 'Hello World' example demonstrating how to execute JavaScript code within Zeek. This serves as a starting point for JS integration.

```javascript
function my_js_func(input) {
  return "Hello from JavaScript with input: " + input;
}

```

--------------------------------

### Configure, Build, and Install Zeek

Source: https://docs.zeek.org/en/current/_sources/building-from-source.rst.txt

The standard process for building and installing Zeek from source. This includes running the configure script, compiling the code, and installing it to the default or a specified prefix.

```console
./configure
make
make install
```

--------------------------------

### Install a Zeek Package by Name

Source: https://docs.zeek.org/en/current/_sources/tutorial/using-packages.rst.txt

Use 'zkg install' followed by the package name to install it from the default package source. This is the most common way to add functionality to Zeek.

```console
# zkg install redis-rce
```

--------------------------------

### Run Zeek Tutorial Setup Script

Source: https://docs.zeek.org/en/current/_sources/tutorial/setup.rst.txt

Executes the setup script to prepare tutorial resources and add tooling. This command is executed inside the container.

```console
# ./setup.sh tutorial
```

--------------------------------

### Originator HTTP Request Example

Source: https://docs.zeek.org/en/current/reference/logs/http.html

An example of an HTTP GET request from a client, including Host and User-Agent headers.

```http
GET / HTTP/1.1
Host: testmyids.com
User-Agent: curl/8.5.0
Accept: */*


```

--------------------------------

### Standard Build and Install Process

Source: https://docs.zeek.org/en/current/building-from-source.html

This is the typical sequence of commands to configure, build, and install Zeek from source. Ensure all dependencies are met before running.

```bash
./configure
make
make install

```

--------------------------------

### Clustered Configuration Example (node.cfg)

Source: https://docs.zeek.org/en/current/_sources/tutorial/invoking-zeekctl.rst.txt

An example configuration for a clustered Zeek setup in '$PREFIX/etc/node.cfg', defining roles like logger, manager, proxy, and workers.

```ini
[logger-1]
type=logger
host=localhost

[manager]
type=manager
host=localhost

[proxy-1]
type=proxy
host=localhost

[worker-1]
type=worker
host=localhost
interface=eth0

[worker-2]
type=worker
host=localhost
interface=eth0
```

--------------------------------

### Process Quickstart PCAP with Zeek

Source: https://docs.zeek.org/en/current/_sources/tutorial/setup.rst.txt

Creates a scratch directory, processes the quickstart PCAP file using Zeek, and lists the generated log files. This command is executed inside the container.

```console
# mkdir scratch && cd scratch
# zeek -r ../traces/zeek-doc/quickstart.pcap
# ls
conn.log  files.log  http.log  packet_filter.log  weird.log
# cd ..
```

--------------------------------

### Payload Content Example for Request Types

Source: https://docs.zeek.org/en/current/_sources/frameworks/signatures.rst.txt

Example of using the payload condition to filter on HTTP request types like GET. This matches the beginning of the payload.

```zeek
payload /GET /
```

--------------------------------

### Example http.log Entry (GET Request)

Source: https://docs.zeek.org/en/current/_sources/reference/logs/pe.rst.txt

This http.log entry details a GET request for the same file as the previous HEAD request, indicating a 'Partial Content' response (206) and providing a file UID.

```json
{
    "ts": "2020-09-23T00:24:31.334435Z",
    "uid": "Cq2b9jR12c4lqZafg",
    "id.orig_h": "192.168.4.152",
    "id.orig_p": 59125,
    "id.resp_h": "63.88.73.83",
    "id.resp_p": 80,
    "trans_depth": 2,
    "method": "GET",
    "host": "r8---sn-8xgp1vo-p5ql.gvt1.com",
    "uri": "/edgedl/release2/chrome/SAWXCyZhLAbPfxC5kv_Fkw_85.0.4183.121/85.0.4183.121_85.0.4183.102_chrome_updater.exe?cms_redirect=yes&mh=t-&mip=-public-ip-edited-&mm=28&mn=sn-8xgp1vo-p5ql&ms=nvh&mt=1600820539&mv=m&mvi=8&pl=19&shardbypass=yes",
    "version": "1.1",
    "user_agent": "Microsoft BITS/7.8",
    "request_body_len": 0,
    "response_body_len": 1392,
    "status_code": 206,
    "status_msg": "Partial Content",
    "tags": [],
    "resp_fuids": [
      "FGYKX64SkXc4OcvlFf"
    ]
  }
```

--------------------------------

### Using the NetControl Skeleton Plugin

Source: https://docs.zeek.org/en/current/frameworks/netcontrol.html

This script demonstrates how to initialize and activate the skeleton plugin, and includes an example of dropping a connection.

```zeek
event NetControl::init() {
    local skeleton_plugin = NetControl::create_skeleton("");
    NetControl::activate(skeleton_plugin, 0);
    }

event connection_established(c: connection) {
    NetControl::drop_connection(c$id, 20 secs);
    }
```

--------------------------------

### Run Zeek Setup Script

Source: https://docs.zeek.org/en/current/tutorial/setup.html

Executes the setup script within the zeek-training directory to prepare tutorial resources and add required tooling. This command is run inside the Zeek container.

```bash
# ./setup.sh tutorial

```

--------------------------------

### Example HTTP Request URI Match

Source: https://docs.zeek.org/en/current/frameworks/signatures.html

Example of matching a URI containing specific strings using http-request. This demonstrates filtering on request types like 'GET' using the payload condition.

```zeek
http-request /.*(etc/(passwd|shadow)/
```

```zeek
payload /GET /
```

--------------------------------

### Hello World JavaScript Example in Zeek

Source: https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_JavaScript.zeekjs.bif.zeek.html

A basic 'Hello World' example demonstrating how to execute a JavaScript function from a Zeek script. This requires the JavaScript plugin to be loaded.

```zeek
@load javascript

// Call a JavaScript function from Zeek
js_eval("console.log('Hello from Zeek JavaScript!');");

```

--------------------------------

### Connection Log Entry Example

Source: https://docs.zeek.org/en/current/_sources/reference/logs/files.rst.txt

An example entry from conn.log showing network connection details, including source/destination IPs, ports, and service type. This log is often the starting point for tracing network activity.

```json
{
  "ts": 1596820191.94147,
  "uid": "CzoFRWTQ6YIzfFXHk",
  "id.orig_h": "192.168.4.37",
  "id.orig_p": 58264,
  "id.resp_h": "23.195.64.241",
  "id.resp_p": 80,
  "proto": "tcp",
  "service": "http",
  "duration": 0.050640106201171875,
  "orig_bytes": 211,
  "resp_bytes": 179604,
  "conn_state": "SF",
  "missed_bytes": 0,
  "history": "ShADadtFf",
  "orig_pkts": 93,
  "orig_ip_bytes": 5091,
  "resp_pkts": 129,
  "resp_ip_bytes": 186320
}
```

--------------------------------

### Hello World JavaScript Example

Source: https://docs.zeek.org/en/current/scripts/builtin-plugins/Zeek_JavaScript/__load__.zeek.html

A basic 'Hello, World!' example demonstrates how to define and execute a simple JavaScript function within Zeek. This function is called when the 'hello_world' event is raised.

```javascript
event hello_world() {
    print "Hello, World!";
}

```

--------------------------------

### Zeekygen Example Script

Source: https://docs.zeek.org/en/current/scripts/zeekygen/index.html

An example Zeek script demonstrating Zeekygen-style documentation. Comments starting with '##!' summarize the script's purpose and are transferred to the generated reStructuredText (reST) document. Custom roles and directives can be embedded within these comments for cross-referencing.

```zeek
##! This is an example script that demonstrates Zeekygen-style documentation. It generally will make most sense when viewing the script’s raw source code and comparing to the HTML-rendered version.
##! Comments in the from `##!` are meant to summarize the script’s purpose. They are transferred directly into the generated reStructuredText (reST) document associated with the script.
# Tip
# You can embed directives and roles within `##`-stylized comments.
# There’s also a custom role to reference any identifier node in the Zeek Sphinx domain that’s good for “see alsos”, e.g.
# See also: `ZeekygenExample::a_var`, `ZeekygenExample::ONE`, `SSH::Info`
# And a custom directive does the equivalent references:
# See also: `ZeekygenExample::a_var`, `ZeekygenExample::ONE`, `SSH::Info`
```

--------------------------------

### HTTP Request Example

Source: https://docs.zeek.org/en/current/_sources/reference/logs/http.rst.txt

This snippet shows a typical HTTP GET request made by a client, including headers like Host and User-Agent.

```console
zeek@zeek:~/zeek-test$ cat 172.017.000.002.54162-217.160.000.187.00080

::

  GET / HTTP/1.1
  Host: testmyids.com
  User-Agent: curl/8.5.0
  Accept: */*
```

--------------------------------

### Hello World JavaScript Example

Source: https://docs.zeek.org/en/current/tutorial/scripting/javascript.html

A basic 'Hello World' example demonstrates how to execute a simple JavaScript function within Zeek. This script will print 'Hello from JavaScript!' to the Zeek log.

```zeek
event zeek_init() {
    // Load the JavaScript engine
    @load javascript;

    // Execute a JavaScript function
    js_eval("print('Hello from JavaScript!')");
}

```

--------------------------------

### Deploy Clustered Zeek Configuration

Source: https://docs.zeek.org/en/current/tutorial/invoking-zeekctl.html

After modifying `$PREFIX/etc/node.cfg` to define a clustered setup, run `deploy` to apply the new topology and start the respective nodes.

```bash
# zeekctl deploy
<...>
starting ...
starting logger ...
starting manager ...
starting proxy ...
starting workers ...


```

--------------------------------

### Zeek Command Line Example

Source: https://docs.zeek.org/en/current/scripts/base/init-bare.zeek.html

Illustrates how to invoke Zeek with '--bare-mode' and script arguments.

```bash
zeek --bare-mode -- myscript.zeek -a -b -c
```

--------------------------------

### Configure and Build Plugin with Zeek Installation

Source: https://docs.zeek.org/en/current/_sources/advanced/devel/plugins.rst.txt

This command sequence shows how to configure and build a plugin when a Zeek installation is available. It assumes 'zeek-config' is in the PATH and proceeds with a standard 'make' process.

```bash
# which zeek-config
/usr/local/zeek/bin/zeek-config
# cd rot13-plugin
# ./configure && make
[... cmake output ...]
```

--------------------------------

### Deploy Default Zeek Cluster

Source: https://docs.zeek.org/en/current/tutorial/invoking-zeekctl.html

The `deploy` command launches the default minimal Zeek cluster, performing configuration checks, installation, and starting processes.

```bash
# zeekctl deploy

checking configurations ...
installing ...
creating policy directories ...
installing site policies ...
generating standalone-layout.zeek ...
generating local-networks.zeek ...
generating zeekctl-config.zeek ...
generating zeekctl-config.sh ...
stopping ...
stopping zeek ...
starting ...
starting zeek ...


```

--------------------------------

### Run Zeek Docker Container

Source: https://docs.zeek.org/en/current/tutorial/setup.html

Starts a Zeek container named 'zeek-tutorial' and enters an interactive bash session within it. This is the initial step to access the Zeek environment.

```bash
$ docker run --name "zeek-tutorial" -it zeek/zeek

```

--------------------------------

### Launch All-in-One Management Instance

Source: https://docs.zeek.org/en/current/_sources/frameworks/management.rst.txt

Run this command as root to start a combined controller and agent for a single-system management setup. The process will remain in the foreground.

```console
# zeek -C -j policy/frameworks/management/controller policy/frameworks/management/agent
```

--------------------------------

### Example Compact HTTP Log Entry

Source: https://docs.zeek.org/en/current/reference/logs/http.html

A single, compact JSON representation of an http.log entry. This shows a typical GET request with response details.

```json
{"ts":1591367999.512593,"uid":"C5bLoe2Mvxqhawzqqd","id.orig_h":"192.168.4.76","id.orig_p":46378,"id.resp_h":"31.3.245.133","id.resp_p":80,"trans_depth":1,"method":"GET","host":"testmyids.com","uri":"/","version":"1.1","user_agent":"curl/7.47.0","request_body_len":0,"response_body_len":39,"status_code":200,"status_msg":"OK","tags":[],"resp_fuids":["FEEsZS1w0Z0VJIb5x4"],"resp_mime_types":["text/plain"]}

```

--------------------------------

### Process Sample Pcap File with Zeek

Source: https://docs.zeek.org/en/current/tutorial/setup.html

Creates a 'scratch' directory, changes into it, and then runs Zeek on a sample pcap file ('../traces/zeek-doc/quickstart.pcap'). This verifies the Zeek installation by checking for generated log files.

```bash
# mkdir scratch && cd scratch
# zeek -r ../traces/zeek-doc/quickstart.pcap
# ls
conn.log  files.log  http.log  packet_filter.log  weird.log
# cd ..

```

--------------------------------

### Command-line Usage Example

Source: https://docs.zeek.org/en/current/_sources/scripts/policy/frameworks/control/controller.zeek.rst.txt

Illustrates how to execute the controller script from the command line to control a remote Zeek instance. Specify the host, port, command, and optional arguments.

```bash
zeek <scripts> frameworks/control/controller Control::host=<host_addr> Control::host_port=<host_port> Control::cmd=<command> [Control::arg=<arg>]
```
Tokens:
Raw