Re: known_*

Jon Siwek <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAMzgZ0KJQPB0Vi6c+_Vw1QHV3uO2XUtAPub-gC1xfT08WAw6Wg@mail.gmail.com>
On Tue, Jul 30, 2019 at 1:09 AM Palumbo Mauro <[email protected]> wrote:

>    there are a number of scripts (known_services, known_hosts, known_certs) which are implemented both using a broker store and sending broker events. It is possible to switch from one mode to the other using the option use_service_store.
>
> Is there any particular reason for this?

Mostly due to not knowing which version better fits the common use-case.

> Is one option more efficient than the other?

No, there's two choices because there's a trade-off: using the Broker
store version is theoretically less scalable because it relies on a
single, centralized node, but the version using events partitions the
data across many nodes in a consistent way via HRW.  With the Broker
store version you have the option of turning on persistence (e.g.
saving data across restarts can prevent duplicate logs, etc.).  With
the version using events there's no option for persistence, although
there's nothing preventing one from combining the two approaches
except complexity of implementing it right: partitioned events +
storing data inside a Broker store.

- Jon
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.