Zeek

https://docs.zeek.org/en/master/
Admin
Zeek is a network security monitoring framework that analyzes network traffic to detect intrusions...
Tokens:1,366,059
Snippets:18,716
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### Run Setup Script

Source: https://docs.zeek.org/en/master/_sources/tutorial/setup.rst.txt

Prepares tutorial resources and installs required tooling.

```console
# ./setup.sh tutorial
```

--------------------------------

### Build and install Zeek

Source: https://docs.zeek.org/en/master/_sources/building-from-source.rst.txt

Standard commands to compile and install the software.

```console
make
```

```console
make install
```

--------------------------------

### Test Plugin After Installation

Source: https://docs.zeek.org/en/master/_sources/advanced/devel/plugins.rst.txt

After installing the plugin using `make install`, test the plugin function again to ensure it is accessible system-wide without needing `ZEEK_PLUGIN_PATH`.

```bash
# make install
# zeek -e 'print Demo::rot13("Hello")'
Uryyb
```

--------------------------------

### Build and Install Zeek

Source: https://docs.zeek.org/en/master/_sources/building-from-source.rst.txt

Standard sequence of commands to configure, compile, and install Zeek.

```console
./configure
make
make install
```

--------------------------------

### Install Zeek to a staging directory

Source: https://docs.zeek.org/en/master/_sources/building-from-source.rst.txt

Use DESTDIR to install files into a staging directory for later deployment.

```bash
DESTDIR=<staging_dir> make install
```

--------------------------------

### Install Zeek on OpenBSD

Source: https://docs.zeek.org/en/master/_sources/install.rst.txt

Use the OpenBSD package manager to install Zeek.

```console
doas pkg_add zeek
```

--------------------------------

### Start Zeek HTTP API Server

Source: https://docs.zeek.org/en/master/_sources/tutorial/scripting/javascript.rst.txt

Launch the Zeek process to start the HTTP API server.

```console
$ zeek -C -i lo ./api.zeek
Listening on 127.0.0.1:8080...
listening on lo
```

--------------------------------

### Install and Verify Zeek Plugin

Source: https://docs.zeek.org/en/master/advanced/devel/plugins.html

Commands to install a plugin and verify its functionality using the Zeek interpreter.

```bash
# make install
# zeek -e 'print Demo::rot13("Hello")'
Uryyb
```

--------------------------------

### Install Zeek Packages

Source: https://docs.zeek.org/en/master/_sources/tutorial/using-packages.rst.txt

Install packages using the default package source or directly via a git URL.

```console
# zkg install redis-rce
```

```console
# zkg install https://github.com/zeek/redis-rce
```

--------------------------------

### HTTP GET Request Example

Source: https://docs.zeek.org/en/master/_sources/frameworks/signatures.rst.txt

Example of matching a regular expression against the payload to filter for specific HTTP request types like GET. This uses the payload condition.

```zeek
payload /GET /
```

--------------------------------

### sub_bytes

Source: https://docs.zeek.org/en/master/_sources/scripts/base/bif/strings.bif.zeek.rst.txt

Get a substring from a string, given a starting position and length.

```APIDOC
## sub_bytes(s: string, start: count, n: int) -> string

### Description
Get a substring from a string, given a starting position and length.

### Parameters
- **s** (string) - The string to obtain a substring from.
- **start** (count) - The starting position of the substring in s, where 1 is the first character. As a special case, 0 also represents the first character.
- **n** (int) - The number of characters to extract, beginning at start.

### Returns
- (string) - A substring of s of length n from position start.
```

--------------------------------

### Execution examples for context-aware scripts

Source: https://docs.zeek.org/en/master/advanced/scripting/conn-id-ctx.html

Command-line examples showing how different connection key plugins affect the output of the context-aware tracking script.

```bash
$ zeek -r vlan-collisions.pcap frameworks/conn_key/vlan_fivetuple conn_id_ctx_my_endpoint.zeek
[ctx=[vlan=42, inner_vlan=<uninitialized>], a=141.142.228.5], HTTP
[ctx=[vlan=10, inner_vlan=20], a=141.142.228.5], HTTP
[ctx=[vlan=<uninitialized>, inner_vlan=<uninitialized>], a=141.142.228.5], HTTP
```

```bash
$ zeek -C -r vxlan-overlapping-http-get.pcap  ConnKey::factory=ConnKey::CONNKEY_VXLAN_VNI_FIVETUPLE conn_id_ctx_my_endpoint.zeek
[ctx=[vxlan_vni=<uninitialized>], a=141.142.228.5], HTTP
[ctx=[vxlan_vni=<uninitialized>], a=127.0.0.1], VXLAN
[ctx=[vxlan_vni=4711], a=141.142.228.5], HTTP
[ctx=[vxlan_vni=4242], a=141.142.228.5], HTTP
```

```bash
$ zeek -C -r vxlan-overlapping-http-get.pcap conn_id_ctx_my_endpoint.zeek
[ctx=[], a=141.142.228.5], HTTP
[ctx=[], a=127.0.0.1], VXLAN
```

--------------------------------

### Initialize Signature Files String

Source: https://docs.zeek.org/en/master/_sources/scripts/base/init-bare.zeek.rst.txt

Default empty string for signature file paths.

```zeek
""
```

--------------------------------

### Installation Constants

Source: https://docs.zeek.org/en/master/scripts/base/misc/installation.zeek.html

The Installation module exposes several constants that define the directory structure of the Zeek installation.

```APIDOC
## Installation Constants

### Description
These constants provide the absolute paths for various directories used by the Zeek installation. These paths are guaranteed to exist, though their usage depends on the specific deployment configuration.

### Constants
- **Installation::etc_dir** (string) - The installation’s configuration directory.
- **Installation::log_dir** (string) - The installation’s log directory.
- **Installation::root_dir** (string) - Zeek installation root directory.
- **Installation::spool_dir** (string) - The installation’s spool directory.
- **Installation::state_dir** (string) - The installation’s variable-state directory.
```

--------------------------------

### Example entries in software.log

Source: https://docs.zeek.org/en/master/_sources/reference/logs/known-and-software.rst.txt

Captures application details and versioning information for hosts on the network.

```json
{
    "ts": "2021-01-03T00:16:22.694616Z",
    "host": "192.168.4.25",
    "software_type": "HTTP::BROWSER",
    "name": "Windows-Update-Agent",
    "version.major": 10,
    "version.minor": 0,
    "version.minor2": 10011,
    "version.minor3": 16384,
    "version.addl": "Client",
    "unparsed_version": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.0"
  }
```

```json
["192.168.4.1","SSH::SERVER","OpenSSH",6,6,1,null,"p1","OpenSSH_6.6.1p1 Debian-4~bpo70+1"]
  ["192.168.4.37","SSH::CLIENT","OpenSSH",6,6,1,null,"p1","OpenSSH_6.6.1p1 Debian-4~bpo70+1"]
  ["192.168.4.37","SSH::CLIENT","OpenSSH",7,6,null,null,"p1","OpenSSH_7.6p1"]
```

--------------------------------

### Initialize Zeek Container

Source: https://docs.zeek.org/en/master/tutorial/setup.html

Starts a new Zeek container named 'zeek-tutorial' and enters an interactive bash session.

```bash
$ docker run --name "zeek-tutorial" -it zeek/zeek
```

--------------------------------

### Install and Run logschema

Source: https://docs.zeek.org/en/master/tutorial/logs.html

Install the logschema package via zkg and generate JSON schemas for installed packages.

```bash
# zkg install logschema
The following packages will be INSTALLED:
  zeek/zeek/logschema (v2.0.0)

Proceed? [Y/n] y
Running unit tests for "zeek/zeek/logschema"
Installing "zeek/zeek/logschema"
Installed "zeek/zeek/logschema" (v2.0.0)
Loaded "zeek/zeek/logschema"
# zeek logschema/export/jsonschema packages
```

--------------------------------

### Install dependencies on FreeBSD

Source: https://docs.zeek.org/en/master/_sources/building-from-source.rst.txt

Install required packages using pkg, including dynamic detection of the installed Python version.

```console
sudo pkg install -y base64 bash bison cmake cppzmq git python3 swig
pyver=`python3 -c 'import sys; print(f"py{sys.version_info[0]}{sys.version_info[1]}")'`
sudo pkg install -y $pyver-sqlite3
```

--------------------------------

### Launch Zeek management instance

Source: https://docs.zeek.org/en/master/frameworks/management.html

Starts an all-in-one management instance in the foreground. Requires root privileges.

```bash
# zeek -C -j policy/frameworks/management/controller policy/frameworks/management/agent
```

--------------------------------

### Basic File Lifecycle Event Handling

Source: https://docs.zeek.org/en/master/_sources/frameworks/file-analysis.rst.txt

This example demonstrates how to hook into basic file lifecycle events to observe file-related information. It highlights the similarity in identifying files and connections.

```zeek
event file_state_remove(f: File)
{
    print f;
    print f.uid;
    print f.conn_info;
    print f.mime_type;
}

event connection_state_remove(c: connection)
{
    print c;
    print c.uid;
    print c.info;
    print c.service;
}

```

--------------------------------

### Install and Export Log Schemas

Source: https://docs.zeek.org/en/master/_sources/tutorial/logs.rst.txt

Install the logschema package using zkg and generate JSON schema files for your Zeek installation.

```console
# zkg install logschema
The following packages will be INSTALLED:
  zeek/zeek/logschema (v2.0.0)

Proceed? [Y/n] y
Running unit tests for "zeek/zeek/logschema"
Installing "zeek/zeek/logschema"
Installed "zeek/zeek/logschema" (v2.0.0)
Loaded "zeek/zeek/logschema"
# zeek logschema/export/jsonschema packages
```

--------------------------------

### Pattern Modifier Examples

Source: https://docs.zeek.org/en/master/reference/zeekscript/types.html

Examples of combining pattern modifiers.

```zeek
/foo/is
```

```zeek
/bar/si
```

--------------------------------

### zeek-client CLI Help Output

Source: https://docs.zeek.org/en/master/_sources/frameworks/management.rst.txt

This example displays the help output for the zeek-client command-line interface. It lists available commands and provides a brief description of their purpose.

```console
usage: zeek-client [-h] [--output-format {json,ini}] <command>

Zeek Management Framework Client

optional arguments:
  -h, --help            show this help message and exit
  --output-format {json,ini}
                        output format for commands that support it

commands:
  {status,list,load,unload,restart,stop,start,logs,shell,version}
    status              Get the status of the management framework
    list                List all managed nodes
    load                Load a node into the management framework
    unload              Unload a node from the management framework
    restart             Restart a managed node
    stop                Stop a managed node
    start               Start a managed node
    logs                Get logs for a managed node
    shell               Open a shell on a managed node
    version             Get the management framework version
```

--------------------------------

### Open and Close a Storage Backend

Source: https://docs.zeek.org/en/master/_sources/frameworks/storage.rst.txt

Demonstrates initializing a SQLite backend connection with specific options and closing it after use.

```zeek
@load base/frameworks/storage/sync
@load policy/frameworks/storage/backend/sqlite

local backend_opts: Storage::BackendOptions;
local backend: Storage::BackendHandle;

# Loading the sqlite policy adds this field to the options record.
opts$sqlite = [$database_path="test.sqlite", $table_name="testing"];

# This is the default, but is shown here for how to set it.
opts$serializer = Storage::STORAGE_SERIALIZER_JSON;

local res = Storage::Sync::open_backend(Storage::STORAGE_BACKEND_SQLITE, opts, string, string);
if ( res$code == Storage::SUCCESS )
  backend = res$value;

res = Storage::Sync::close_backend(backend);
```

--------------------------------

### Install Zeek Build Dependencies on Windows

Source: https://docs.zeek.org/en/master/_sources/building-from-source.rst.txt

Installs essential build tools and dependencies for Zeek using Chocolatey. Ensure Chocolatey is installed and Developer Mode is enabled in Windows.

```console
choco install -y --no-progress visualstudio2019buildtools --version=16.11.11.0
choco install -y --no-progress visualstudio2019-workload-vctools --version=1.0.0 --package-parameters '--add Microsoft.VisualStudio.Component.VC.ATLMFC'
choco install -y --no-progress sed
choco install -y --no-progress winflexbison3
choco install -y --no-progress msysgit
choco install -y --no-progress python
```

--------------------------------

### Install Zeek on OpenBSD

Source: https://docs.zeek.org/en/master/install.html

Command to install Zeek from the OpenBSD ports collection.

```bash
doas pkg_add zeek
```

--------------------------------

### View help documentation

Source: https://docs.zeek.org/en/master/_sources/tutorial/invoking-zeek.rst.txt

Access the built-in help menu for Zeek command-line options.

```console
# zeek --help
zeek version 8.0.4
...
```

--------------------------------

### Broker Store Listener Implementation

Source: https://docs.zeek.org/en/master/frameworks/broker.html

Demonstrates how to create a clone store and perform asynchronous lookups on keys. Requires a running master store to synchronize with.

```zeek
 1redef exit_only_after_terminate = T;
 2
 3global h: opaque of Broker::Store;
 4global expected_key_count = 4;
 5global key_count = 0;
 6
 7# Lookup a value in the store based on an arbitrary key string.
 8function do_lookup(key: string)
 9    {
10    when ( local res = Broker::get(h, key) )
11        {
12        ++key_count;
13        print "lookup", key, res;
14
15        # End after we iterated over looking up each key in the store twice.
16        if ( key_count == expected_key_count * 2 )
17            terminate();
18        }
19    # All data store queries must specify a timeout
20    timeout 3sec
21        { print "timeout", key; }
22    }
23
24event check_keys()
25    {
26    # Here we just query for the list of keys in the store, and show how to
27    # look up each one's value.
28    when ( local res = Broker::keys(h) )
29        {
30        print "clone keys", res;
31
32        if ( res?$result )
33            {
34            # Since we know that the keys we are storing are all strings,
35            # we can conveniently cast the result of Broker::keys to
36            # a native Bro type, namely 'set[string]'.
37            for ( k in res$result as string_set )
38                do_lookup(k);
39
40            # Alternatively, we can use a generic iterator to iterate
41            # over the results (which we know is of the 'set' type because
42            # that's what Broker::keys() always returns).  If the keys
43            # we stored were not all of the same type, then you would
44            # likely want to use this method of inspecting the store's keys.
45            local i = Broker::set_iterator(res$result);
46
47            while ( ! Broker::set_iterator_last(i) )
48                {
49                do_lookup(Broker::set_iterator_value(i) as string);
50                Broker::set_iterator_next(i);
51                }
52            }
53        }
54    # All data store queries must specify a timeout.
55    # You also might see timeouts on connecting/initializing a clone since
56    # it hasn't had time to get fully set up yet.
57    timeout 1sec
58        {
59        print "timeout";
60        schedule 1sec { check_keys() };
61        }
62    }
63
64event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string)
65    {
66    print "peer added";
67    # We could create a clone early, like in zeek_init and it will periodically
68    # try to synchronize with its master once it connects, however, we just
69    # create it now since we know the peer w/ the master store has just
70    # connected.
71    h = Broker::create_clone("mystore");
72
73    event check_keys();
74    }
75
76event zeek_init()
77    {
78    Broker::listen("127.0.0.1");
79    }
```

--------------------------------

### Install Zeek on FreeBSD

Source: https://docs.zeek.org/en/master/install.html

Command to install Zeek from the FreeBSD ports collection.

```bash
sudo pkg install -y zeek
```

--------------------------------

### Example Zeek log entries

Source: https://docs.zeek.org/en/master/reference/logs/ftp.html

Sample output showing connection and FTP command logs for a specific UID.

```json
{
  "_path": "conn",
  "_system_name": "ds61",
  "_write_ts": "2020-08-16T06:26:10.266225Z",
  "_node": "worker-01",
  "ts": "2020-08-16T06:26:01.485394Z",
  "uid": "CLkXf2CMo11hD8FQ5",
  "id.orig_h": "192.168.4.76",
  "id.orig_p": 53380,
  "id.resp_h": "196.216.2.24",
  "id.resp_p": 21,
  "proto": "tcp",
  "service": "ftp",
  "duration": 3.780829906463623,
  "orig_bytes": 184,
  "resp_bytes": 451,
  "conn_state": "SF",
  "local_orig": true,
  "local_resp": false,
  "missed_bytes": 0,
  "history": "ShAdDafF",
  "orig_pkts": 20,
  "orig_ip_bytes": 1232,
  "resp_pkts": 17,
  "resp_ip_bytes": 1343,
  "ip_proto": 6,
  "community_id": "1:lEESxqaSVYqFZvWNb4OccTa9sTs="
}
{
  "_path": "ftp",
  "_system_name": "ds61",
  "_write_ts": "2020-08-16T06:26:04.077276Z",
  "_node": "worker-01",
  "ts": "2020-08-16T06:26:03.553287Z",
  "uid": "CLkXf2CMo11hD8FQ5",
  "id.orig_h": "192.168.4.76",
  "id.orig_p": 53380,
  "id.resp_h": "196.216.2.24",
  "id.resp_p": 21,
  "user": "anonymous",
  "password": "ftp@example.com",
  "command": "EPSV",
  "reply_code": 229,
  "reply_msg": "Entering Extended Passive Mode (|||31746|).",
  "data_channel.passive": true,
  "data_channel.orig_h": "192.168.4.76",
  "data_channel.resp_h": "196.216.2.24",
  "data_channel.resp_p": 31746
}
{
  "_path": "ftp",
  "_system_name": "ds61",
  "_write_ts": "2020-08-16T06:26:05.117287Z",
  "_node": "worker-01",
  "ts": "2020-08-16T06:26:04.597290Z",
  "uid": "CLkXf2CMo11hD8FQ5",
  "id.orig_h": "192.168.4.76",
  "id.orig_p": 53380,
  "id.resp_h": "196.216.2.24",
  "id.resp_p": 21,
  "user": "anonymous",
  "password": "ftp@example.com",
  "command": "RETR",
  "arg": "ftp://196.216.2.24/pub/stats/afrinic/delegated-afrinic-extended-latest.md5",
  "file_size": 74,
  "reply_code": 226,
  "reply_msg": "Transfer complete.",
  "fuid": "FueF95uKPrUuDnMc4"
}
```

--------------------------------

### Example Kerberos Log Entry

Source: https://docs.zeek.org/en/master/reference/logs/smb.html

A sample entry from kerberos.log confirming the use of Kerberos authentication over SMB.

```json
{
  "ts": 1507562478.110863,
  "uid": "CzgIrZ31Lh5vCHioWi",
  **"id.orig_h": "192.168.10.31",**
  "id.orig_p": 49282,
  **"id.resp_h": "192.168.10.10",**
  **"id.resp_p": 445**
}
```

--------------------------------

### Install Zeek on FreeBSD

Source: https://docs.zeek.org/en/master/_sources/install.rst.txt

Use the FreeBSD package manager to install Zeek.

```console
sudo pkg install -y zeek
```

--------------------------------

### WebSocket Handshake GUID

Source: https://docs.zeek.org/en/master/_sources/scripts/base/protocols/websocket/consts.zeek.rst.txt

The standard GUID used for WebSocket handshake validation.

```zeek
"258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
```

--------------------------------

### Initialize Zeek repository

Source: https://docs.zeek.org/en/master/_sources/advanced/devel/hacking.rst.txt

Clone the repository and initialize submodules.

```shell
# git clone https://github.com/zeek/zeek zeek
# cd zeek
# git submodule update --init --recursive
```

--------------------------------

### Configure and Install Zeek with PF_RING

Source: https://docs.zeek.org/en/master/_sources/cluster/pf_ring.rst.txt

Commands to configure Zeek to use the installed PF_RING libraries and then build and install Zeek. The `--with-pcap` flag points Zeek to the PF_RING libpcap directory.

```bash
./configure --with-pcap=/opt/pfring
make
make install
```

--------------------------------

### Install dependencies on FreeBSD

Source: https://docs.zeek.org/en/master/building-from-source.html

Commands to install required packages and Python-specific modules on FreeBSD.

```bash
sudo pkg install -y base64 bash bison cmake cppzmq git python3 swig
pyver=`python3 -c 'import sys; print(f"py{sys.version_info[0]}{sys.version_info[1]}")'`
sudo pkg install -y $pyver-sqlite3
```

--------------------------------

### Configure remote logging

Source: https://docs.zeek.org/en/master/_sources/frameworks/broker.rst.txt

Example of setting up a log stream for remote distribution.

```zeek
redef Log::enable_remote_logging = T;

module TestLog;

export {
	redef enum Log::ID += { LOG };

	type Info: record {
		ts: time &log;
		msg: string &log;
	};
}

event zeek_init()
	{
	Log::create_stream(TestLog::LOG, [$columns=Info, $path="test"]);
	Log::write(TestLog::LOG, [$ts=network_time(), $msg="hello"]);
	}

```

--------------------------------

### Start Zeek Container

Source: https://docs.zeek.org/en/master/_sources/tutorial/setup.rst.txt

Launches the Zeek container from the host machine.

```console
$ docker run --name "zeek-tutorial" -it zeek/zeek
```

--------------------------------

### Install Zeek on macOS

Source: https://docs.zeek.org/en/master/_sources/install.rst.txt

Use Homebrew to install the Zeek binary package on macOS.

```console
brew install zeek
```

--------------------------------

### Configure and Build Plugin Against Zeek Installation

Source: https://docs.zeek.org/en/master/_sources/advanced/devel/plugins.rst.txt

This command sequence shows how to configure and build a plugin when a Zeek installation is available in the system's PATH. It assumes 'zeek-config' is accessible.

```bash
# which zeek-config
/usr/local/zeek/bin/zeek-config
# cd rot13-plugin
# ./configure && make
[... cmake output ...]
```

--------------------------------

### Configure Zeek installation prefix

Source: https://docs.zeek.org/en/master/_sources/building-from-source.rst.txt

Use the configure script to set the installation directory.

```bash
./configure --prefix=<dir>
```

--------------------------------

### Example Connection Log Entries

Source: https://docs.zeek.org/en/master/reference/logs/smb.html

Sample entries from conn.log showing SMB-related traffic and Windows broadcast messages.

```json
{
  "ts": 1507565438.203425,
  "uid": "CR7Vww4LuLkMzi4jMd",
  **"id.orig_h": "192.168.10.31",**
  "id.orig_p": 49238,
  **"id.resp_h": "192.168.10.30",**
  **"id.resp_p": 445,**
  "proto": "tcp",
  **"service": "krb,smb,gssapi",**
  "duration": 1.1398930549621582,
  "orig_bytes": 814051,
  "resp_bytes": 11657,
  "conn_state": "S1",
  "missed_bytes": 0,
  "history": "ShADda",
  "orig_pkts": 66,
  "orig_ip_bytes": 816703,
  "resp_pkts": 91,
  "resp_ip_bytes": 15309,
  "ip_proto": 6
}
{
  "ts": 1507565425.183882,
  "uid": "CyeWAg1QrRKQL0HHMi",
  "id.orig_h": "192.168.10.30",
  "id.orig_p": 138,
  **"id.resp_h": "192.168.10.255",**
  **"id.resp_p": 138,**
  "proto": "udp",
  "conn_state": "S0",
  "missed_bytes": 0,
  "history": "D",
  "orig_pkts": 1,
  "orig_ip_bytes": 207,
  "resp_pkts": 0,
  "resp_ip_bytes": 0,
  "ip_proto": 17
}
```
Tokens:
Raw