Zeek package management¶
Corelight-update implements some basic package management functions, similar to the Zeek Package Manager (ZKG). https://docs.zeek.org/projects/package-manager/en/stable/
Corelight-update Zeek Package Management can:
Build package bundles from a manifest file by downloading packages from the Internet.
Build package bundles from a manifest file in offline mode.
Push package bundles, built by Corelight-update, to sensors through an inventory file.
Push package bundles, built off-box, to sensors through an inventory file.
Corelight-update only generates package bundles from a manifest file. While Corelight-update can push package bundles that are created by other sources, it does not install packages locally or edit existing bundles.
Warning
Enabling “offline_mode” only prevents downloading the Zeek Package Index. If a URL is provided to a package repo in the manifest file, it still attempts to clone it.
The policy settings for Zeek Package Management are:
# Push Content to Sensors
push_content:
package_bundle: false
# Enable Corelight Package Management
# Creates a package bundle for |cs|s
# Must be disabled to push external bundles
package_management:
enabled: false
offline_mode: false
manifest_file: "bundle.manifest"
bundle_name: "corelight.bundle" # Located in global-bundle or local-bundle
The inventory settings for pushing Zeek Packages are:
# push package bundle to this sensor
bundle: true
bundle_path: "/etc/corelight/corelight.bundle" # software sensors ONLY
ZKG and Software Sensor
Pushing a package bundle to a Software Sensor uses SCP and requires a path to place the bundle. When Corelight-update pushes a package bundle to a Software Sensor, it uses ZKG on the sensor to install the package bundle.
Create and push a package bundle¶
To create and push a package bundle:
Enable
package_management
in the policy configuration.Place a manifest file in the policy configuration folder.
Set
push_package_bundle: true
in the policy.Ensure
bundle: true
in the inventory file for the desired sensors.
Push external package bundles¶
To push a package bundle created outside of Corelight-update:
Disable
package_management
in the policy configurationPlace the package bundle in the
global-bundle
orlocal-bundle
folderA package bundle in
local-bundle
takes precedence
Set
push_content: package_bundle: true
in the policyEnsure
bundle: true
in the inventory file for the desired sensor