Re: Where to get detect-webapps log file?
Sachinji Giri <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CACwQ=9ycRVwsOLQs9oy7y0ERg0RNMGBK1m6nDBnYX7Pf2=W=Og@mail.gmail.com> |
Hi, sorry, there is http.log too. It got generated when browsed some of the data. I am watching the interface with -i. On Fri 21 Jun, 2019, 9:40 PM Richard Bejtlich, <[email protected]> wrote: > Hello, > > I don't see a http.log. That implies that you may not have seen any HTTP > traffic. Can you share a pcap of what you are watching? > > Sincerely, > > Richard > > On Fri, Jun 21, 2019 at 6:58 AM Sachinji Giri <[email protected]> > wrote: > >> Hi there, >> I am using zeek in a container with hosts network. My bro/zeek version is >> following. Bold text are the commands that get executed in the container. >> >> # docker run --cap-add=NET_RAW --net=host --rm blacktop/*zeek --version* >> bro version 2.6-255 >> >> I ran zeek with detect-webapps bro script from policy. I browsed a couple >> of phpadmin websites etc but *I could not get any logs specific to >> detect-webapps.* >> >> # docker run --cap-add=NET_RAW --net=host --rm blacktop/*zeek -i >> 'enp2s0' protocols/http/detect-webapps* >> listening on enp2s0 >> ~~~~~ >> >> It runs forever and I got following log files : >> >> conn.log dns.log packet_filter.log weird.log >> dhcp.log files.log ssl.log x509.log >> >> *Where to get detect-webapps log file?* >> >> *What does detect-webapps do and where it logs its data?* >> >> Any help will be much appreciated. >> -- >> Regards, >> Sachin Giri >> _______________________________________________ >> Zeek mailing list >> [email protected] >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > > > > -- > Richard Bejtlich > Principal Security Strategist, Corelight > _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek