Compiling Zeek Scripts

[oneCrazyAdmin]

Hi All!

I was hoping to get a little help. I would like to have zeek look at our MS-SQL traffic. there is a zeek script for that https://github.com/amzn/zeek-plugin-tds

However, you have to compile the custom module for that to work. Other than setting up a separate Centos 7 instance, how would one go about compiling and using this (or other) zeek scripts that need a module compiled?

[dougburks]

You might want to stay tuned for an upcoming release!

[oneCrazyAdmin]

One more question, my TDS (SQL) is not on the standard 1433 port. How do I change that in the zeek config? I found it in the tds package on the sensor, but it will be overwritten if I change it there.

[dougburks]

Perhaps you could override the default port as shown here:
https://docs.securityonion.net/en/2.3/zeek.html#modifying-base-protocol-scripts

[oneCrazyAdmin]

I was hoping that would be the way to do it, but I couldn't figure out the location of the scripts to make that change.

[dougburks]

I haven't tested this, but I think it should be something along these lines.

Create a new Zeek script at /opt/so/saltstack/local/salt/zeek/policy/custom/override-tds-port (replacing 1337 with your TDS port):

const ports = { 1337/tcp };

event zeek_init() &priority=5
        {
        Analyzer::register_for_ports(Analyzer::ANALYZER_TDS, ports);
        }

Then enable that new script as shown at https://docs.securityonion.net/en/2.3/zeek.html#custom-scripts.

[oneCrazyAdmin]

thanks, I will take a look and see if that works.

[EbolaWare]

If you're antsy for it, I'd suggest making your own in a docker container. Then the container would be aware of all the build stuff necessary. When you've completed the build, tag the image and docker push to the local repo.

[oneCrazyAdmin]

Thanks! I think that I will wait until a new release!