Zeek Package Manager (ZKG)

Quickstart guide

These instructions are intended for installations of ZKG on the same host as a Software Sensor.

Dependencies

Note that following the ZKG installation process via pip3 will automatically install its dependencies for you.

Installation

It is recommended to use the latest version of pip3:

sudo python3 -m pip install --upgrade --upgrade-strategy only-if-needed pip

To install the latest release of ZKG on PyPi:

sudo python3 -m pip install zkg

Basic setup

ZKG supports four broad approaches for managing Zeek packages. These details represent one of those approaches and are specific for a Corelight Software Sensor running as root.

  1. Create the directory for the ZKG configurations.

    sudo mkdir /root/.zkg
    
  2. Create/Edit the file /root/.zkg/config and add the following contents:

    [sources]
    zeek = https://github.com/zeek/packages
    
    [paths]
    state_dir = /root/.zkg
    script_dir = /etc/corelight
    zeek_dist =
    
  3. Run the following command to refresh the Zeek index and create the /etc/corelight/packages directory.

    sudo zkg refresh
    
  4. Edit /etc/corelight/local.zeek and add the following line:

    @load /etc/corelight/packages
    

Usage

Corelight-update will use ZKG to manage package bundles on a Software Sensor.

Check the output of zkg –help for an explanation of all available functionality of the command-line tool.