Re: Where to get detect-webapps log file?
Sachinji Giri <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CACwQ=9z4uBDsOYioozhL-n_RMDYmsGaFX+9G6+uiCb1uj4tK8w@mail.gmail.com> |
*browsed some http websites and then http.log appears. what exactly the detect web apps log look like or it is just a part of http.log?? i really don't know. On Fri 21 Jun, 2019, 9:45 PM Sachinji Giri, <[email protected]> wrote: > Hi, sorry, there is http.log too. It got generated when browsed some of > the data. > > I am watching the interface with -i. > > On Fri 21 Jun, 2019, 9:40 PM Richard Bejtlich, <[email protected]> > wrote: > >> Hello, >> >> I don't see a http.log. That implies that you may not have seen any HTTP >> traffic. Can you share a pcap of what you are watching? >> >> Sincerely, >> >> Richard >> >> On Fri, Jun 21, 2019 at 6:58 AM Sachinji Giri <[email protected]> >> wrote: >> >>> Hi there, >>> I am using zeek in a container with hosts network. My bro/zeek version >>> is following. Bold text are the commands that get executed in the container. >>> >>> # docker run --cap-add=NET_RAW --net=host --rm blacktop/*zeek >>> --version* >>> bro version 2.6-255 >>> >>> I ran zeek with detect-webapps bro script from policy. I browsed a >>> couple of phpadmin websites etc but *I could not get any logs specific >>> to detect-webapps.* >>> >>> # docker run --cap-add=NET_RAW --net=host --rm blacktop/*zeek -i >>> 'enp2s0' protocols/http/detect-webapps* >>> listening on enp2s0 >>> ~~~~~ >>> >>> It runs forever and I got following log files : >>> >>> conn.log dns.log packet_filter.log weird.log >>> dhcp.log files.log ssl.log x509.log >>> >>> *Where to get detect-webapps log file?* >>> >>> *What does detect-webapps do and where it logs its data?* >>> >>> Any help will be much appreciated. >>> -- >>> Regards, >>> Sachin Giri >>> _______________________________________________ >>> Zeek mailing list >>> [email protected] >>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek >> >> >> >> -- >> Richard Bejtlich >> Principal Security Strategist, Corelight >> > _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek