Updating Zeek 2.5.3

Zeek
1

Hello there,

I was wondering if theres a way to update the signature database in Zeek 2.5.3 without updating to a newer version of Zeek.

V/R
Charles S. Garbag

2

Do you mean the Team Cymru malware hashes? If so, I believe the database is not stored on disk but instead those are network (DNS TXT record) lookups. The Zeek scripting examples actually walks through that one at https://docs.zeek.org/en/stable/examples/scripting/.

3

Hi,

I was wondering if theres a way to update the signature database in Zeek
2.5.3 without updating to a newer version of Zeek.

What exactly do you mean by the signature database?

Zeek is not really signature centric like other projects - and does not
come with an internal database of attack signatures (or similar) - hence
the question :).

If you install additional scripts that perform detection (e.g. from
bro-pkg) - a lot of them will run on several versions of Zeek.

Johanna