Zeek package management¶
Corelight-update implements some basic package management functions, similar to the Zeek Package Manager (ZKG). https://docs.zeek.org/projects/package-manager/en/stable/
Corelight-update Zeek Package Management can:
Build package bundles from a manifest file by downloading packages from the Internet.
Build package bundles from a manifest file in offline mode.
Push package bundles, built by Corelight-update, to Fleet Manager policies and/or sensors.
Push package bundles, built off-box, to Fleet Manager policies and/or sensors.
Push Corelight signed package bundles to all sensors except Software Sensor v1.x sensors.
Corelight-update only generates package bundles from a manifest file. While Corelight-update can push package bundles that are created by other sources, it does not install packages locally or edit existing bundles.
Warning
Enabling “offline_mode” only prevents downloading the Zeek Package Index. If a URL is provided to a package repo in the manifest file, it still attempts to clone it.
The policy settings for Zeek Package Management are:
# Push Content to Sensors
push_content:
package_bundle: false
# Enable Corelight Package Management
# Creates a package bundle for |cs|s
# Must be disabled to push external bundles
package_management:
enabled: false
offline_mode: false
manifest_file: "bundle.manifest"
bundle_name: "corelight.bundle" # Located in global-bundle or local-bundle
signed: false # for externally created bundles only
The inventory settings for pushing Zeek Packages are:
# push package bundle to this sensor
bundle: true
bundle_path: "/etc/corelight/corelight.bundle" # software sensors ONLY
ZKG and Software Sensor v1.x
Pushing a package bundle to a Software Sensor v1.x uses SCP and requires a path to place the bundle. After Corelight-update pushes a package bundle, it uses ZKG on the sensor to install the packages.
For details on how to install and setup ZKG on a Software Sensor v1.x, see Zeek Package Manager (ZKG)
Create and push a package bundle¶
To create and push a package bundle:
Enable
package_management
in the policy configuration.Set the name of the manifest file. For example,
manifest_file: bundle.manifest
Place a manifest file in the policy configuration folder.
Set
push_package_bundle: true
in the policy.Ensure
bundle: true
in the inventory file for the desired sensors.If the manifest file changes, a new bundle will automatically be created and pushed each time the Corelight-update service runs.
Optionally, force create and push a bundle with the CLI command
corelight-update -b <policy name>
Push external package bundles¶
To push a package bundle created outside of Corelight-update:
Disable
package_management
in the policy configurationSet the name of the bundle. For example,
bundle_name: corelight.bundle
Place the package bundle in the
global-bundle
orlocal-bundle
folderA package bundle in
local-bundle
takes precedence
Set
push_content: package_bundle: true
in the policyEnsure
bundle: true
in the inventory file for the desired sensorExternal bundles are not automatically pushed to sensors. They must be pushed with the CLI command
corelight-update -b <policy name>