Support Plugins on Zeek

[webreakit]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

16

Storage for /

200GB

Storage for /nsm

4000GB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Playing around with a new install on a site which has a lot of CAPWAP traffic on the network, wondering if it's possible to add support for loading plugins in Zeek?

For example, this CAPWAP plugin would be useful in my case: CAPWAP Analyzer

Guessing this could be similar to how custom scripts are handled, for example:

/opt/so/saltstack/default/salt/zeek/config.sls

zeekplugindir:
file.directory:
- name: /opt/so/conf/zeek/plugins
- user: 937
- group: 939
- makedirs: True

zeekpluginsync:
file.recurse:
- name: /opt/so/conf/zeek/plugins
- source: salt://zeek/plugins
- user: 937
- group: 939
- template: jinja
- defaults:
FILE_EXTRACTION: {{ ZEEKMERGED.file_extraction }}

/opt/so/saltstack/default/salt/zeek/enabled.sls

• binds:

  • /opt/so/conf/zeek/plugins:/opt/zeek/share/zeek/site/packages:ro

• watch:

  • file: /opt/so/conf/zeek/plugins

/opt/so/saltstack/default/salt/zeek/default.yaml

zeekctl:
SitePolicyScripts: /opt/zeek/share/zeek/site/packages

load-plugin:
- /<Plugin_name>

Plus the UI for SOC to add "load-plugin" as an additional field.

Or alternatively, build and include this package if possible in the Dockerfile for so-zeek. It would be great if there was the ability to customise the Dockerfiles.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.