Bronze IHi,
I've done the Q1-15 and added the SHA1 Hash from Q14 to the hash-intel.txt. When i rerun the pcap with "zeek -r demonstrate.pcap", no logs for the Intel-Files will be created (no token generated on the desktop)... any help?
Now i was able to solve it. I copied the zeek.local file and run it manually through console. That worked... i don't know why the standard run command didn't work 🤷♂️
@ netcat: thank you!
Silver IIDid you do the lab "Zeek: Ep.6 – File Analysis Framework" (sucessfully)?
I might be wrong, but https://github.com/zeek/zeekctl says that you should run "zeekctl deploy" after each configuration change. And I'm afraid that statement is true.
- My script works when running via command line
- My script doesn't run when added to the local.zeek file
- File hashes are always calculated, also after removing that include from local.zeek
And ofc we can't run zeekctl...we're doomed, almost. It can be done, I just did it (Ep.1-7 and Demonstrate Your Skills).
Hint:
Ignore the lab instructions and do not "Follow instructions and rerun the first command in shell". I repeat, do not. Maybe that worked in the past, but not with the current lab. For me, the signatures part didn't work either, had to figure it out manually. And the last question is quite "interesting", too.
Bronze INow i was able to solve it. I copied the zeek.local file and run it manually through console. That worked... i don't know why the standard run command didn't work 🤷♂️
@ netcat: thank you!
Community Manager
Bronze IIII cant remember this lab....my notes simply state
"Follow instructions and rerun the first command in shell"
Maybe this will help or not....Gus
Community ManagerHi lupolder - welcome to the community.
Demonstrate Labs are technically challenging labs that offer very limited information and guidance, they are supposed to be challenging and consolidate your learning from all of the other labs in the collection (in this case, the 8 labs in the Zeek Collection).
As a result, the level of detail of the hints and tips that the community are able to share here is limited.
If you haven't already, I recommend that you complete all of the labs in the collection, and if it's been a while since you did, you might want to refresh your memory.
