Zeek scripting and threat intelligence
With the Zeek scripting language you write detections that react to events, feed the intelligence framework and extend Zeek with packages.
Level 301 · 15 lessons · 12 practice labs
Lessons
The scripting language
- The event model: zeek_init, connection_established, http_request
- Types, records, tables and sets
- Your first Zeek script: printing connections to a given port
- Short task: write a script counting connections per host
Your own logs and notices
- Creating your own log file: Log::create_stream
- Raising custom notices and suppression intervals
- Threshold-based detection with SumStats
- Short task: raise a notice for a host touching 20 ports in a minute
Intelligence and packages
- The intel framework: IP, domain and hash indicators
- Formatting indicator lists and keeping them current
- Installing and reviewing Zeek packages with zkg
- The file analysis framework: hashing and saving files
- Testing scripts with PCAPs and version control
- Short task: report connections matching an indicator list
- Capstone: write and test three custom Zeek detections for an organisation
Practice labs
- First script: connections to one port: Write a script printing every connection to port 8080 and run it on a capture.
- Count connections per host: Write a script counting connections opened per source with a table and printing them at the end.
- Build a set from HTTP requests: Collect the unique domains each host reached in a set on the http_request event and print the three most varied.
- Create your own log file: Define a custom three-field log stream with Log::create_stream and show a line being written.
- Raise a custom notice: Write a script raising a custom notice for inbound connections to a management port.
- Prevent a notice flood with a suppression interval: Define a notice suppression interval so one host raises it once an hour and verify with a capture.
- Collect observations with SumStats: Define a SumStats observation counting failed connections per source and print the result.
- The host touching twenty different ports: Raise a threshold-based notice for a host connecting to 20 different ports in a minute.
- Tune the threshold not to false-alarm: Tune the threshold and interval with a normal and a scanning capture and show false alarms drop to zero.
- Format an indicator file: Write three IPs, two domains and one file hash in the tab-separated format the intelligence framework expects.
- Report connections matching indicators: Load the indicator list and extract from intel.log which host matched which indicator.
- Install and review a zkg package: Install a Zeek package with zkg, review its scripts, test with a PCAP and document the log fields it adds.
About this course
With the Zeek scripting language you write detections that react to events, feed the intelligence framework and extend Zeek with packages.
What you will learn
- The scripting language
- Your own logs and notices
- Intelligence and packages
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.