Zeek package management

Corelight-update implements some basic package management functions, similar to the Zeek Package Manager (ZKG). https://docs.zeek.org/projects/package-manager/en/stable/

Corelight-update Zeek Package Management can:

  • Build package bundles from a manifest file by downloading packages from the Internet.

  • Build package bundles from a manifest file in offline mode.

  • Push package bundles, built by Corelight-update, to sensors through an inventory file.

  • Push package bundles, built off-box, to sensors through an inventory file.

Corelight-update only generates package bundles from a manifest file. While Corelight-update can push package bundles that are created by other sources, it does not install packages locally or edit existing bundles.

Warning

Enabling “offline_mode” only prevents downloading the Zeek Package Index. If a URL is provided to a package repo in the manifest file, it still attempts to clone it.

The policy settings for Zeek Package Management are:

# Push Content to Sensors
push_content:
  package_bundle: false

# Enable Corelight Package Management
# Creates a package bundle for |cs|s
# Must be disabled to push external bundles
package_management:
  enabled:                    false
  offline_mode:               false
  manifest_file:              "bundle.manifest"
  bundle_name:                "corelight.bundle" # Located in global-bundle or local-bundle

The inventory settings for pushing Zeek Packages are:

# push package bundle to this sensor
bundle:         true
bundle_path:    "/etc/corelight/corelight.bundle"     # software sensors ONLY

ZKG and Software Sensor

Pushing a package bundle to a Software Sensor uses SCP and requires a path to place the bundle. When Corelight-update pushes a package bundle to a Software Sensor, it uses ZKG on the sensor to install the package bundle.

Create and push a package bundle

To create and push a package bundle:

  1. Enable package_management in the policy configuration.

  2. Place a manifest file in the policy configuration folder.

  3. Set push_package_bundle: true in the policy.

  4. Ensure bundle: true in the inventory file for the desired sensors.

Push external package bundles

To push a package bundle created outside of Corelight-update:

  1. Disable package_management in the policy configuration

  2. Place the package bundle in the global-bundle or local-bundle folder

    • A package bundle in local-bundle takes precedence

  3. Set push_content: package_bundle: true in the policy

  4. Ensure bundle: true in the inventory file for the desired sensor