Use Zeek’s Intelligence Framework¶
Load a safe domain indicator, generate matching traffic, and verify the resulting record in intel.log.
Before you begin
Use an authorised lab host and record the Zeek version, operating-system version, interface name, and command output used for validation.
Zeek’s Intelligence Framework¶
Introduction¶
The goals of Zeek’s Intelligence Framework are to consume intelligence data, make it available for matching, and provide infrastructure to improve performance and memory utilization.
Data in the Intelligence Framework is an atomic piece of intelligence such as an IP address or an e-mail address. This atomic data will be packed with metadata such as a freeform source field, a freeform descriptive field, and a URL which might lead to more information about the specific item. The metadata in the default scripts has been deliberately kept to a minimum.
Quick Start¶
Verify that there is no file named intel.log in the /opt/zeek/logs/current/
First we need to define the intelligence data to match. Let’s look for the domain www.reddit.com. For the details of the file format see the Loading Intelligence section below.
The file should look like this (with tabs instead of spaces):
#fields<TAB>indicator<TAB>indicator_type<TAB>meta.source
www.reddit.com<TAB>Intel::DOMAIN<TAB>my_special_source
Now we need to tell Zeek about the data. Add this line to your /opt/zeek/share/zeek/site/local.zeek to load an intelligence file:
Add the following line to local.zeek to load the scripts that send “seen” data into the Intelligence Framework to be checked against the loaded intelligence data:
If you want your logs to be generated in JSON format, add the following line to local.zeek
Save local.zeek and redeploy Zeek via Zeekctl
Navigate to www.reddit.com on a web browser or run curl https://www.reddit.com
Verify that intel.log is generated in the /opt/zeek/logs/current/ directory.
ls -la /opt/zeek/logs/current/intel.log
-rw-r--r-- 1 root zeek 1003 Sep 13 17:34 /opt/zeek/logs/current/intel.log
Intelligence data matches will be logged to the intel.log file. A match on www.reddit.com might look like this:
TSV Format:
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path intel
#open 2024-09-13-17-34-18
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc
#types time string addr port addr port string enum enum string set[enum] set[string] string string string
1726205657.998538 CqUrI04Y7fFPsytdRe 10.0.0.25 47594 8.8.8.8 53 www.reddit.com Intel::DOMAIN DNS::IN_REQUEST zeek Intel::DOMAIN my_special_source - - -
1726205657.999634 Cifoa91ikOBbh89gn6 10.0.0.25 39683 8.8.8.8 53 www.reddit.com Intel::DOMAIN DNS::IN_REQUEST zeek Intel::DOMAIN my_special_source - - -
1726205658.134483 CDfw3o3w2dyFyCK4J1 10.0.0.25 49050 151.101.65.140 80 www.reddit.com Intel::DOMAIN HTTP::IN_HOST_HEADER zeek Intel::DOMAIN my_special_source - --
1726205661.327155 Cgj6iV1JWK1QPFoE5d 10.0.0.25 51836 151.101.193.140 80 www.reddit.com Intel::DOMAIN HTTP::IN_HOST_HEADER zeek Intel::DOMAIN my_special_source - --
JSON format:
Show the full captured output
{
"ts": 1726206423.770539,
"uid": "CGLHKn3xKB169eRyuc",
"id.orig_h": "10.0.0.25",
"id.orig_p": 54142,
"id.resp_h": "151.101.65.140",
"id.resp_p": 80,
"seen.indicator": "www.reddit.com",
"seen.indicator_type": "Intel::DOMAIN",
"seen.where": "HTTP::IN_HOST_HEADER",
"seen.node": "zeek",
"matched": [
"Intel::DOMAIN"
],
"sources": [
"my_special_source"
]
}
Intelligence checkpoint
Confirm that intel.log records www.reddit.com, Intel::DOMAIN, and my_special_source in the same match.