123. Zeek (formerly Bro) Network Security Monitor | Log Collection Solutions

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

  
<Extension _json>
    Module     xm_json
</Extension>

<Extension w3c_parser>
    Module     xm_w3c
</Extension>

<Input zeek>
    Module     im_file
    File       '/opt/zeek/logs/current/*.log'
    InputType  w3c_parser
</Input>

<Output zeek_json>
    Module     om_file
    File       '/tmp/zeek_logs.json'
    Exec       to_json();
</Output>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

  
<Extension csv_parser_dns>
    Module      xm_csv
    Fields      ts, uid id.orig_h, id.orig_p, id.resp_h, id.resp_p, proto, \
                trans_id, rtt query, qclass, qclass_name, qtype, qtype_name, \
                rcode, rcode_name, AA, TC, RD, RA, Z, answers, TTLs, rejected
    Delimiter   \t
</Extension>

<Extension csv_parser_dhcp>
    Module      xm_csv
    Fields      ts, uid, id.orig_h, id.orig_p, id.resp_h, id.resp_p, mac, \
                assigned_ip, lease_time, trans_id
    Delimiter   \t
</Extension>

# xm_fileop provides the `file_basename()` function
<Extension _fileop>
    Module      xm_fileop
</Extension>

<Extension json>
    Module  xm_json
</Extension>

<Input zeek>
    Module      im_file
    File        '/opt/zeek/spool/zeek/*.log'
    <Exec>
        if file_basename(file_name()) == 'dhcp.log'
        {
            csv_parser_dhcp->parse_csv();
        }
        else if file_basename(file_name()) == 'dns.log'
        {
            csv_parser_dns->parse_csv();
        }
        else
        {
            log_warning('Zeek log type not supported, check configuration');
            drop();
        }
    </Exec>
</Input>

<Output zeek_json>
    Module      om_file
    File        '/tmp/ce_zeek_logs.json'
    Exec        to_json();
</Output>