search

Security-Onion-Solutions / security-onion

Security Onion 16.04 - Linux distro for threat hunting, enterprise security monitoring, and log management
https://securityonion.net
3.06k stars 521 forks source link

securityonion-sostat: migrate from Bro to Zeek #1692

Closed dougburks closed 4 years ago

weslambert commented 4 years ago

Confirmed sostat contains no instance of [Bb]ro other than the following lines that are cleaned up from the zeekctl response:

su sguil -c '/opt/zeek/bin/zeekctl netstats 2>&1 | grep -v "Warning: ZeekControl plugin uses legacy BroControl API. Use" | grep -v "import BroControl.plugin" | grep -v "^$" ' > $TMP

Looks good 👍

dougburks commented 4 years ago

Published: https://blog.securityonion.net/2020/02/zeek-301-elastic-686-and-cyberchef-9120.html