Writing Zeek Rules and Scripts from Pluralsight

Zeek is a customizable, open-source tool that allows you to monitor the network and analyze events within it. This course will teach how to customize it through the use of custom rules, scripts, and policies.

Zeek is an event-based network monitoring and analysis tool used to help monitor the network and detect potential threats. It enables users to see the traffic going through our networks and respond to it in different ways. Learning how to customize its functionality through the use of rules and scripts can help you use this tool more effectively. In this course, Writing Zeek Rules and Scripts, you will learn all about this tool's frameworks and how to use them to customize the tool, as well as how to use it. First, you will learn about the various components used with Zeek customization and scripting. Next, you will learn about the Default scripts and how to modify them to suit your needs. Finally, you will practice using the frameworks to build the needed functionality for your use cases. When you're finished with this course, you will have the ability to modify Zeek in order to support your desired use cases and environment.

What's inside

Syllabus

Course Overview

Illustrating the Zeek Signature Framework

Managing Events with the Logging and Notice Frameworks

Breaking Down the Scripting Basics

Traffic lights

Read about what's good

what should give you pause

and possible dealbreakers

Introduces the Zeek tool's Sigature Framework, Event Management System, Scripting Basics, Default Script Optimization, and Script Customization Frameworks

In-depth training on customizing Zeek's functionality for specific use cases

Led by Joe Abraham, an expert in network monitoring and Zeek customization

May require some prior experience with network monitoring and analysis, as it is not a beginner-friendly course

Teaches the customization of Zeek through the use of custom rules, scripts, and policies, which can be valuable for network administrators

Taught by an instructor experienced in information security

Reviews summary

Comprehensive zeek scripting and customization

According to learners, this course is a largely positive and practical guide for customizing Zeek. Students frequently highlight the instructor's clear explanations and expertise, making complex topics accessible. The emphasis on hands-on labs and practical examples is consistently praised for solidifying understanding and enabling immediate application. While it provides a strong foundation in Zeek frameworks and scripting, some students note that it's best suited for those with prior networking or programming knowledge, as it can move quickly. Overall, it’s highly recommended for professionals seeking to deeply customize Zeek.

Older feedback mentioned outdated content and presentation issues.

"Decent course, but felt some parts were a bit outdated with the latest Zeek versions."

"Content is good, but the production quality of some videos seemed a bit low, and the audio was inconsistent."

"I wish there were more troubleshooting tips for common errors encountered during scripting."

Offers a strong foundation, but some desire more advanced topics.

"Good for absolute beginners though... felt it could use more advanced topics or real-world use cases beyond the basics."

"My only minor critique is that some sections could have more depth."

"A solid introduction to Zeek rules... could use more advanced topics or real-world use cases beyond the basics."

Provides a thorough understanding of Zeek's core frameworks.

"Excellent course for anyone looking to dive deep into Zeek scripting."

"Good course for understanding Zeek's architecture and scripting capabilities."

"The course goes deep into the frameworks, providing a thorough understanding."

Instructor's expertise and clear explanations are highly praised.

"The instructor explains complex topics clearly and the hands-on labs are incredibly helpful."

"The instructor's teaching style is very engaging."

"Absolutely fantastic! The instructor's expertise shines through."

Highly valued for its practical labs and real-world application.

"The hands-on labs are incredibly helpful. I especially appreciated the sections on the notice and logging frameworks."

"This course really improved my ability to customize Zeek. The practical examples and clear explanations made learning easy."

"The demonstrations were clear and I liked how it focused on real-world application."

Requires existing networking or programming background; fast-paced.

"I found some parts moved a bit quickly, assuming prior knowledge of certain networking concepts..."

"Found this course quite challenging. It assumes a lot of prior knowledge in programming and networking. Not for beginners..."

"The pace was fast and I struggled to keep up without supplemental material."

Activities

Be better prepared before your course. Deepen your understanding during and after it. Supplement your coursework and achieve mastery of the topics covered in Writing Zeek Rules and Scripts with these activities:

Build a sample network

Show steps

Build a sample network to gain hands-on experience with the course materials.

Browse courses on Network Monitoring

Show steps

Design a simple network topology
Install Zeek on the network
Configure Zeek to monitor traffic

Show all one activities

Career center

Learners who complete Writing Zeek Rules and Scripts will develop knowledge and skills that may be useful to these careers:

Security Engineer

Security Engineers design, implement, and manage security solutions for an organization's computer networks and systems. Often working in conjunction with Information Security Analysts and Network Architects, Security Engineers may find this course useful because it teaches how to customize and extend the Zeek tool, which can be a very valuable asset for their work in maintaining and improving the security of a network.

See salaries and explore the career path for Security Engineer

Information Security Analyst

Information Security Analysts plan and implement security measures to protect data and technology assets within a company. They identify and manage risks and can benefit from understanding how to modify and customize security analysis tools, such as Zeek. This course provides direct training in how to maximize the utility of this tool to support a range of use cases, which can help an Information Security Analyst in their daily work.

See salaries and explore the career path for Information Security Analyst

Network Architect

Network Architects design, build, and maintain computer and communications networks within an organization. They are responsible for planning, implementing, supporting, and managing the network. Having a strong understanding of how to customize and extend monitoring tools such as Zeek is very useful for this role, as it helps Network Architects tailor security and maintenance solutions for the network they manage.

See salaries and explore the career path for Network Architect

Network Administrator

Network Administrators install, configure, and maintain computer networks within an organization. They are responsible for ensuring that the network is running smoothly and securely. Taking this course can be useful for Network Administrators because it provides training in how to customize and extend the Zeek monitoring tool, which can help them monitor and maintain the network more effectively.

See salaries and explore the career path for Network Administrator

IT Auditor

IT Auditors evaluate the efficiency, security, and financial controls within an organization. Having a strong understanding of how to customize and extend monitoring tools such as Zeek is beneficial for this role, as it helps IT Auditors assess the effectiveness of security measures and identify areas for improvement.

See salaries and explore the career path for IT Auditor

Security Analyst

Security Analysts monitor and analyze computer systems and networks for security breaches and threats. They investigate security incidents and make recommendations for improving security. This course may be useful for Security Analysts because it provides training in how to customize and extend the Zeek monitoring tool, which can help them monitor and analyze security threats more effectively.

See salaries and explore the career path for Security Analyst

Ethical Hacker

Ethical Hackers use their skills and knowledge of computer systems to identify and exploit vulnerabilities in order to help organizations improve their security. This course can be useful for Ethical Hackers because it provides training in how to customize and extend the Zeek monitoring tool, which can help them identify and exploit vulnerabilities more effectively.

See salaries and explore the career path for Ethical Hacker

Penetration Tester

Penetration Testers assess the security of computer systems and networks by simulating attacks. They identify and exploit vulnerabilities in order to help organizations improve their security. This course can be useful for Penetration Testers because it provides training in how to customize and extend the Zeek monitoring tool, which can help them identify and exploit vulnerabilities more effectively.

See salaries and explore the career path for Penetration Tester

Computer Systems Analyst

Computer Systems Analysts explore and determine how computer systems can be utilized to meet the goals of the organization. Often working on teams with System Administrators, this role would benefit from taking this course as it offers training in methods for customizing and extending the functionality of the Zeek monitoring tool. This can help a Computer Systems Analyst build and design tools that support the security of the network and infrastructure.

See salaries and explore the career path for Computer Systems Analyst

Security Consultant

Security Consultants provide advice and guidance to organizations on how to improve their security posture. This course may be useful for Security Consultants because it provides training in how to customize and extend the Zeek monitoring tool, which can help them assess an organization's security posture and make recommendations for improvement.

See salaries and explore the career path for Security Consultant

Information Security Specialist

Information Security Specialists implement and maintain security measures to protect an organization's information and technology assets. This course may be useful for Information Security Specialists because it provides training in how to customize and extend the Zeek monitoring tool, which can help them implement and maintain security measures more effectively.

See salaries and explore the career path for Information Security Specialist

Malware Analyst

Malware Analysts investigate and analyze malware to understand how it works and how to protect against it. This course may be useful for Malware Analysts because it provides training in how to customize and extend the Zeek monitoring tool, which can help them analyze malware more effectively.

See salaries and explore the career path for Malware Analyst

Data Analyst

Data Analysts play a crucial role in transforming raw data into meaningful and actionable insights. While this course is not directly related to data analysis, it provides training in how to customize and extend the Zeek monitoring tool, which can be useful for Data Analysts working with security or network data. This course can help Data Analysts build tools to support their analysis and decision-making.

See salaries and explore the career path for Data Analyst

Computer Scientist

Computer Scientists research, design, and develop computer systems and applications. This course is not directly related to the research and development of computer systems and applications, but it may be useful for Computer Scientists working on projects involving security or monitoring software. The course provides training in how to customize and extend the Zeek monitoring tool, which can be helpful for developing security tools and applications.

See salaries and explore the career path for Computer Scientist

Software Developer

Software Developers design, develop, and implement computer and software applications or systems. While this course is not directly related to the design and development of applications, it may be useful for Software Developers who work on projects involving security or monitoring software. The course provides training in how to customize and extend the Zeek monitoring tool, which can be helpful for developing security tools and applications.

See salaries and explore the career path for Software Developer

Writing Zeek Rules and Scripts

What's inside

Syllabus

Traffic lights

Save this course

Reviews summary

Comprehensive zeek scripting and customization

Activities

Career center

Reading list

Share

Similar courses