Zeek Package Manager (ZKG)¶
Quickstart guide¶
These instructions are intended for installations of ZKG on the same host as a Microsensor.
Dependencies¶
Python 3.6+
git: https://git-scm.com
GitPython: https://pypi.python.org/pypi/GitPython
semantic_version: https://pypi.python.org/pypi/semantic_version
Note that following the ZKG installation process via pip3 will automatically install its dependencies for you.
Installation¶
It is recommended to use the latest version of pip3:
sudo python3 -m pip install --upgrade --upgrade-strategy only-if-needed pip
To install the latest release of ZKG on PyPi:
sudo python3 -m pip install zkg
Basic setup¶
ZKG supports four broad approaches for managing Zeek packages. These details represent one of those approaches and are specific for a Corelight Microsensor running as root.
Create the directory for the ZKG configurations.
sudo mkdir /root/.zkg
Create/Edit the file
/root/.zkg/config
and add the following contents:[sources] zeek = https://github.com/zeek/packages [paths] state_dir = /root/.zkg script_dir = /etc/corelight zeek_dist =
Run the following command to refresh the Zeek index and create the
/etc/corelight/packages
directory.sudo zkg refresh
Edit
/etc/corelight/local.zeek
and add the following line:@load /etc/corelight/packages
Usage¶
Corelight-update will use ZKG to manage package bundles on a Microsensor.
Check the output of zkg –help for an explanation of all available functionality of the command-line tool.