{"id":8845,"date":"2021-05-17T23:15:44","date_gmt":"2021-05-17T20:15:44","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8845"},"modified":"2024-03-18T22:23:43","modified_gmt":"2024-03-18T19:23:43","slug":"install-zeek-on-ubuntu","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-zeek-on-ubuntu\/","title":{"rendered":"Install Zeek on Ubuntu 20.04"},"content":{"rendered":"\n

Follow through this tutorial to learn how to install Zeek on Ubuntu 20.04. Zeek<\/a>, formerly Bro IDS, is the world’s leading passive open source network security monitoring tool.<\/p>\n\n\n\n

Zeek is not an active security device, like a firewall or intrusion prevention system. Rather, Zeek sits on a \u201csensor,\u201d a hardware, software, virtual, or cloud platform that quietly and unobtrusively observes network traffic. Zeek interprets what it sees and creates compact, high-fidelity transaction logs, file content, and fully customized output, suitable for manual review on disk or in a more analyst-friendly tool like a security and information event management (SIEM) system<\/em>.<\/p>\n\n\n\n

Installing Zeek on Ubuntu 20.04<\/h2>\n\n\n\n

Zeek can be installed by building it from the source code<\/a> or by directly via the Zeek APT repositories<\/a>.<\/p>\n\n\n\n

In this tutorial, we will choose the later.<\/p>\n\n\n\n

To install Zeek from the Zeek APT repositories;<\/p>\n\n\n\n

Add Zeek repository to Ubuntu 20.04:<\/p>\n\n\n\n

echo 'deb http:\/\/download.opensuse.org\/repositories\/security:\/zeek\/xUbuntu_20.04\/ \/' | sudo tee \/etc\/apt\/sources.list.d\/security:zeek.list<\/code><\/pre>\n\n\n\n
curl -fsSL https:\/\/download.opensuse.org\/repositories\/security:zeek\/xUbuntu_20.04\/Release.key | gpg --dearmor | sudo tee \/etc\/apt\/trusted.gpg.d\/security_zeek.gpg > \/dev\/null<\/code><\/pre>\n\n\n\n
Run system update;<\/p>\n\n\n\n
apt update<\/code><\/pre>\n\n\n\n
Zeek 4.0.1 is the current stable release as of this writing, confirm the same by running the command below;<\/p>\n\n\n\n
apt-cache policy zeek<\/code><\/pre>\n\n\n\n
zeek:\n  Installed: (none)\n  Candidate: 4.0.1-0\n  Version table:\n     4.0.1-0 500\n        500 http:\/\/download.opensuse.org\/repositories\/security:\/zeek\/xUbuntu_20.04  Packages<\/code><\/pre>\n\n\n\n
You can then install Zeek by running the command below;<\/p>\n\n\n\n
apt install zeek<\/code><\/pre>\n\n\n\n
During the installation, you will be prompted for some Postfix settings, choose Internet Site and enter your system FQDN.<\/p>\n\n\n\n
Configuring Zeek on Ubuntu 20.04<\/h3>\n\n\n\n
Configure the Run-Time Environment<\/h4>\n\n\n\n
By default, Zeek is installed under \/opt\/zeek<\/strong><\/code>.<\/p>\n\n\n\n
To begin with, add Zeek binary path to PATH;<\/p>\n\n\n\n
echo \"export PATH=$PATH:\/opt\/zeek\/bin\" >> ~\/.bashrc<\/code><\/pre>\n\n\n\n
source ~\/.bashrc<\/code><\/pre>\n\n\n\n
Define the Local Networks to Monitor<\/h4>\n\n\n\n
Next, you need to tell Zeek which local networks to monitor. This can be specified in the \/opt\/zeek\/etc\/networks.cfg<\/strong><\/code> configuration file.<\/p>\n\n\n\n
The default networks defined are 10.0.0.0\/8, 172.16.0.0\/16, 192.168.0.0\/16<\/strong>. So, in our case, the network  we want to monitor is 192.168.59.0\/24<\/strong>.<\/p>\n\n\n\n
Hence;<\/p>\n\n\n\n
vim \/opt\/zeek\/etc\/networks.cfg<\/code><\/pre>\n\n\n\n
\n# List of local networks in CIDR notation, optionally followed by a\n# descriptive tag.\n# For example, \"10.0.0.0\/8\" or \"fe80::\/64\" are valid prefixes.\n\n#10.0.0.0\/8          Private IP space\n#172.16.0.0\/12       Private IP space\n#192.168.0.0\/16      Private IP space\n192.168.59.0\/24      Kifarunix-demo IP space<\/strong>\n<\/code><\/pre>\n\n\n\n
Save the file and exit once you made your network configuration changes.<\/p>\n\n\n\n
Configure Zeek Cluster<\/h4>\n\n\n\n
Zeek can be run in standalone mode or in a cluster setup. To define whether to run in a cluster or standalone setup, you need to edit the \/opt\/zeek\/etc\/node.cfg<\/strong><\/code> configuration file.<\/p>\n\n\n\n