A saltstack formula to install the Zeek Network Security Monitor on RHEL or Debian based systems.
Supports one capture interface at the moment. Adding ability to control multiple capture interfaces is on the TODO list
Table of Contents
Formulas exist to help with installation and management of other components such as pf_ring.
pfring-formula https://github.com/saltstack-formulas/pfring-formula
Compile a custom Zeek package using the guide RPM package creation for ZEEK IDS Deployments https://alias454.com/rpm-package-creation-for-bro-ids-deployments/.
See the full SaltStack Formulas installation and usage instructions.
If you are interested in writing or contributing to formulas, please pay attention to the Writing Formula Section.
If you want to use this formula, please pay attention to the FORMULA file and/or git tag, which contains the currently released version. This formula is versioned according to Semantic Versioning.
See Formula Versioning Section for more details.
If you need (non-default) configuration, please pay attention to the pillar.example file and/or Special notes section.
Commit message formatting is significant!!
Please see How to contribute for more details.
zeek ^^^^^^^ Meta-state (This is a state that includes other states).
Installs zeek and it's requirements, manages the configuration file, and starts the service.
Manage repo files for RHEL or Debian based systems.
Install prerequisite packages.
Install zeek packages. This formula can support deploying a custom binary built to your own specs.
Manage configuration file placement.
Manage BPF module and configuration. Supports a single zeek-bpf.conf file that applies to all capture interfaces.
If using sendmail(postfix), manage relay host and service.
Manage zeek service and supprt configuring a service to manage promiscuous mode of defined network interfaces on RHEL/Debian systems.
Manage rsyslog config and service to send logs to a remote collector.
Manage zkg pip module and plugin installations.
Manage zeekctl cron entry for housekeeping tasks.
Linux testing is done with kitchen-salt.
- Ruby
- Docker
$ gem install bundler
$ bundle install
$ bin/kitchen test [platform]Where [platform] is the platform name defined in kitchen.yml, e.g. debian-9-2019-2-py3.
Creates the docker instance and runs the zeek main state, ready for testing.
Runs the inspec tests on the actual instance.
Removes the docker instance.
Runs all of the stages above in one go: i.e. destroy + converge + verify + destroy.
Gives you SSH access to the instance for manual testing if automated testing fails.