search

Security-Onion-Solutions / securityonion

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
https://securityonion.net
3.22k stars 498 forks source link

Enable community id support for Zeek & Suricata #210

Closed defensivedepth closed 4 years ago

defensivedepth commented 4 years ago

Enable Community ID support:

1) Zeek - https://github.com/corelight/bro-community-id#using-the-package

2) Suricata - https://suricata.readthedocs.io/en/suricata-5.0.0/output/eve/eve-json-output.html#community-flow-id

3) add mapping to logstash template

4) Edit Kibana dashboards to allow pivot to Indicators dashboard

defensivedepth commented 4 years ago

@TOoSmOotH https://github.com/corelight/bro-community-id For Zeek

TOoSmOotH commented 4 years ago

This has been pushed. Just needs the Bro scriptage