Re: known_*
Jon Siwek <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAMzgZ0KJQPB0Vi6c+_Vw1QHV3uO2XUtAPub-gC1xfT08WAw6Wg@mail.gmail.com> |
On Tue, Jul 30, 2019 at 1:09 AM Palumbo Mauro <[email protected]> wrote: > there are a number of scripts (known_services, known_hosts, known_certs) which are implemented both using a broker store and sending broker events. It is possible to switch from one mode to the other using the option use_service_store. > > Is there any particular reason for this? Mostly due to not knowing which version better fits the common use-case. > Is one option more efficient than the other? No, there's two choices because there's a trade-off: using the Broker store version is theoretically less scalable because it relies on a single, centralized node, but the version using events partitions the data across many nodes in a consistent way via HRW. With the Broker store version you have the option of turning on persistence (e.g. saving data across restarts can prevent duplicate logs, etc.). With the version using events there's no option for persistence, although there's nothing preventing one from combining the two approaches except complexity of implementing it right: partitioned events + storing data inside a Broker store. - Jon _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek