Zeek package management

Corelight-update implements some basic package management functions, similar to the Zeek Package Manager (ZKG). https://docs.zeek.org/projects/package-manager/en/stable/

Corelight-update Zeek Package Management can:

  • Build package bundles from a manifest file by downloading packages from the Internet.

  • Build package bundles from a manifest file in offline mode.

  • Push package bundles, built by Corelight-update, to Fleet Manager policies and/or sensors.

  • Push package bundles, built off-box, to Fleet Manager policies and/or sensors.

  • Push Corelight-signed package bundles to all sensors except Microsensor.

Corelight-update only generates package bundles from a manifest file. While Corelight-update can push package bundles that are created by other sources, it does not install packages locally or edit existing bundles.

Warning

Enabling “offline_mode” only prevents downloading the Zeek Package Index. If a URL is provided to a package repo in the manifest file, it still attempts to clone it.

The policy settings for Zeek Package Management are:

# Push Content to Sensors
push_content:
  package_bundle: false

# Enable Corelight Package Management
# Creates a package bundle for |cs|s
# Must be disabled to push external bundles
package_management:
  enabled:                    false
  offline_mode:               false
  manifest_file:              "bundle.manifest"
  bundle_name:                "corelight.bundle" # Located in global-bundle or local-bundle
  signed:                     false              # for externally created bundles only

The inventory settings for pushing Zeek Packages are:

# push package bundle to this sensor
bundle:         true
bundle_path:    "/etc/corelight/corelight.bundle"     # micro sensors ONLY

ZKG and Microsensor

Pushing a package bundle to a Microsensor uses SCP and requires a path to place the bundle. After Corelight-update pushes a package bundle, it uses ZKG on the sensor to install the packages.

For details on how to install and setup ZKG on a Microsensor, see Zeek Package Manager (ZKG)

Create and push a package bundle

To create and push a package bundle:

  1. Enable package_management in the policy configuration.

  2. Set the name of the manifest file. For example, manifest_file: bundle.manifest

  3. Place a manifest file in the policy configuration folder.

  4. Set push_package_bundle: true in the policy.

  5. Ensure bundle: true in the inventory file for the desired sensors.

  6. If the manifest file changes, a new bundle will automatically be created and pushed each time the Corelight-update service runs.

    • Optionally, force create and push a bundle with the CLI command corelight-update -b <policy name>

Push external package bundles

To push a package bundle created outside of Corelight-update:

  1. Disable package_management in the policy configuration

  2. Set the name of the bundle. For example, bundle_name: corelight.bundle

  3. Place the package bundle in the global-bundle or local-bundle folder

    • A package bundle in local-bundle takes precedence

  4. Set push_content: package_bundle: true in the policy

  5. Ensure bundle: true in the inventory file for the desired sensor

  6. External bundles are not automatically pushed to sensors. They must be pushed with the CLI command corelight-update -b <policy name>