Re: Documentation about Corelight's Splunk Apps for Zeek
Patrick Kelley <[email protected]> Fri, 20 Dec 2019 09:35:15 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CA+WAcdQz2eyS9RALxoeRva1MjBOjKPahOxx_5Xq5nSEyHzzLQA@mail.gmail.com> |
--===============2081733744== Content-Type: multipart/alternative; boundary="000000000000acbc55059a2396cf" --000000000000acbc55059a2396cf Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Seconding the statements of Eric, Splunk costs can get to be expensive extremely quick with Zeek. My only secondary suggestion is that you ingest individual logs to provide a bit more granularity and control. You might not wish to ingest every log due to the processing and storage costs. In the past, I've tried leveraging Splunk multiple times due to my familiarity. In the end, we've built our stack around Elastic. We were just spending too much time servicing the hammer, instead of building the house. On Fri, Dec 20, 2019 at 9:29 AM [email protected] <[email protected]> wrote= : > Hi Carlos, > > =E2=80=9CBest=E2=80=9D is subjective. For someone who wants all logs and= a short > inputs.conf file, your suggestion will work. My example is geared toward= s > the fact that these logs are large and depending on your Splunk license a= nd > requirements, you may not actually want to ingest every single log file > into your system. Ultimately, you know your environment and needs best > which is why I also state in the writeup: > > "An example inputs.conf is below but may or may not include the logs you > wish to ingest...Modify the index and sourcetype configurations to your > needs.=E2=80=9D > > Hope that helps! > Eric > > On Dec 20, 2019, at 8:22 AM, Carlos Lopez <[email protected]> wrote: > > Thanks Eric. But I have doubt with your setup. For inputs.conf, maybe thi= s > configuration is best? > > [monitor:///opt/zeek/logs/spool/current] > disabled =3D 0 > sourcetype =3D zeek:json > whitelist =3D \.log$ > > instead of to put file by file? > -- > Regards, > C. L. Martinez > > *From: *Eric Ooi <[email protected]> > *Date: *Friday, 20 December 2019 at 13:52 > *To: *Amber Graner <[email protected]>, Carlos Lopez < > [email protected]> > *Cc: *"[email protected]" <[email protected]> > *Subject: *Re: [Zeek] Documentation about Corelight's Splunk Apps for Zee= k > > Assuming you=E2=80=99re doing an install on a standalone Splunk server, y= ou can > use my guide here: > https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-= to-splunk/ > > > ------------------------------ > *From:* [email protected] on behalf of Amber Graner < > [email protected]> > *Sent:* Friday, December 20, 2019 6:13 AM > *To:* Carlos Lopez > *Cc:* [email protected] > *Subject:* Re: [Zeek] Documentation about Corelight's Splunk Apps for Zee= k > > > Hi Carlos, > > As that is a Corelight offering and not something maintained by the Zeek > Project or the community, we=E2=80=99d have to refer you to Corelight. > > Let me find out who you need to talk to and I=E2=80=99ll make introductio= ns. > > Thanks, > ~Amber > > On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <[email protected]> wrote: > > Hi all, > > I would like to install Corelight App For Splunk and TA for Corelight, bu= t > there is no documentation about how to accomplish it =E2=80=A6 All info p= oints to > https://www.corelight.com/support/, but there is no docs in there =E2=80= =A6 > > Any idea? > > > -- > Regards, > C. L. Martinez > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek > <http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek> > > -- > > *Amber Graner* > Director of Community > Corelight, Inc > > 828.582.9469 > > Schedule time on my calendar here. <https://calendly.com/amber_graner> > > [image: Image removed by sender.] [image: Image removed by sender.] > > * Ask me about how you can participate in the Zeek (formerly Bro) > community. > * Remember - ZEEK AND YOU SHALL FIND!! > > > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --=20 *Patrick Kelley, CISSP, C|EH, ITIL* *CTO* [email protected] (o) 770-224-6482 --000000000000acbc55059a2396cf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Seconding the statements of Eric, Splunk costs can get to = be expensive extremely quick with Zeek.=C2=A0<br><br>My only secondary sugg= estion is that you ingest individual logs to provide a bit more granularity= and control.=C2=A0 You might not wish to ingest every log due to the proce= ssing and storage costs.<div><br></div><div>In the past, I've tried lev= eraging Splunk multiple times due to my familiarity.=C2=A0 In the end, we&#= 39;ve built our stack around Elastic.=C2=A0</div><div><br></div><div>We wer= e just spending too much time servicing the hammer, instead of building the= house.=C2=A0</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cl= ass=3D"gmail_attr">On Fri, Dec 20, 2019 at 9:29 AM <a href=3D"mailto:ericoo= [email protected]">[email protected]</a> <<a href=3D"mailto:[email protected]"= >[email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote= " style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);= padding-left:1ex"><div style=3D"overflow-wrap: break-word;"><div>Hi Carlos,= </div><div><br></div><div>=E2=80=9CBest=E2=80=9D is subjective.=C2=A0 For s= omeone who wants all logs and a short inputs.conf file, your suggestion wil= l work.=C2=A0 My example is geared towards the fact that these logs are lar= ge and depending on your Splunk license and requirements, you may not actua= lly want to ingest every single log file into your system.=C2=A0 Ultimately= , you know your environment and needs best which is why I also state in the= writeup:</div><div><br></div><div>"An example inputs.conf is below bu= t may or may not include the logs you wish to ingest...Modify the index and= sourcetype configurations to your needs.=E2=80=9D</div><div><br></div><div= >Hope that helps!</div><div>Eric</div><div><br></div><div><div><blockquote = type=3D"cite"><div>On Dec 20, 2019, at 8:22 AM, Carlos Lopez <<a href=3D= "mailto:[email protected]" target=3D"_blank">[email protected]</a>> wr= ote:</div><br><div><div style=3D"font-family:Helvetica;font-size:12px;font-= style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:nor= mal;text-align:start;text-indent:0px;text-transform:none;white-space:normal= ;word-spacing:0px;text-decoration:none"><div style=3D"margin:0cm 0cm 0.0001= pt;font-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"EN-US">Than= ks Eric. But I have doubt with your setup. For inputs.conf, maybe this conf= iguration is best?<u></u><u></u></span></div><div style=3D"margin:0cm 0cm 0= .0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"EN-US"= ><u></u>=C2=A0<u></u></span></div><div style=3D"margin:0cm 0cm 0.0001pt;fon= t-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"EN-US" style=3D"f= ont-size:10pt;font-family:"Courier New"">[<a style=3D"color:blue;= text-decoration:underline">monitor:///opt/zeek/logs/spool/current</a>]<u></= u><u></u></span></div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;= font-family:Calibri,sans-serif"><span lang=3D"EN-US" style=3D"font-size:10p= t;font-family:"Courier New"">disabled =3D 0<u></u><u></u></span><= /div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calib= ri,sans-serif"><span lang=3D"EN-US" style=3D"font-size:10pt;font-family:&qu= ot;Courier New"">sourcetype =3D zeek:json<u></u><u></u></span></div><d= iv style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif"><span lang=3D"EN-US" style=3D"font-size:10pt;font-family:"Cour= ier New"">whitelist =3D \.log$<u></u><u></u></span></div><div style=3D= "margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><sp= an lang=3D"EN-US"><u></u>=C2=A0<u></u></span></div><div style=3D"margin:0cm= 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"= EN-US">instead of to put file by file?<u></u><u></u></span></div><div><div = style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-se= rif"><span lang=3D"EN-US">--=C2=A0<u></u><u></u></span></div><div><div styl= e=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"= ><span lang=3D"EN-US">Regards,<u></u><u></u></span></div></div></div><div s= tyle=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-ser= if"><span lang=3D"EN-US">C. L. Martinez</span><span lang=3D"EN-US"><u></u><= u></u></span></div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;fon= t-family:Calibri,sans-serif"><span lang=3D"EN-US"><u></u>=C2=A0<u></u></spa= n></div><div style=3D"border-style:solid none none;border-top-width:1pt;bor= der-top-color:rgb(181,196,223);padding:3pt 0cm 0cm"><div style=3D"margin:0c= m 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><b><span styl= e=3D"font-size:12pt">From:<span>=C2=A0</span></span></b><span style=3D"font= -size:12pt">Eric Ooi <<a href=3D"mailto:[email protected]" target=3D"_bl= ank">[email protected]</a>><br><b>Date:<span>=C2=A0</span></b>Friday, 20= December 2019 at 13:52<br><b>To:<span>=C2=A0</span></b>Amber Graner <<a= href=3D"mailto:[email protected]" target=3D"_blank">akgraner@coreligh= t.com</a>>, Carlos Lopez <<a href=3D"mailto:[email protected]" targe= t=3D"_blank">[email protected]</a>><br><b>Cc:<span>=C2=A0</span></b>&qu= ot;<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>&quo= t; <<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>= ><br><b>Subject:<span>=C2=A0</span></b>Re: [Zeek] Documentation about Co= relight's Splunk Apps for Zeek<u></u><u></u></span></div></div><div><di= v style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-= serif"><u></u>=C2=A0<u></u></div></div><div><div><div><div><div style=3D"ma= rgin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Assumi= ng you=E2=80=99re doing an install on a standalone Splunk server, you can u= se my guide here: <a href=3D"https://www.ericooi.com/zeekurity-zen-part-iii= -how-to-send-zeek-bro-logs-to-splunk/" target=3D"_blank">https://www.ericoo= i.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-to-splunk/</a><u></u= ><u></u></div></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-s= ize:11pt;font-family:Calibri,sans-serif"><u></u>=C2=A0<u></u></div></div></= div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:C= alibri,sans-serif">=C2=A0<u></u><u></u></div></div><div class=3D"MsoNormal"= align=3D"center" style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-fami= ly:Calibri,sans-serif;text-align:center"><hr size=3D"0" width=3D"100%" alig= n=3D"center"></div><div id=3D"gmail-m_-8102060181968517547divRplyFwdMsg"><d= iv style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif"><b>From:</b><span>=C2=A0</span><a href=3D"mailto:zeek-bounces@zeek.= org" target=3D"_blank">[email protected]</a> on behalf of Amber Graner = <<a href=3D"mailto:[email protected]" target=3D"_blank">akgraner@co= relight.com</a>><br><b>Sent:</b><span>=C2=A0</span>Friday, December 20, = 2019 6:13 AM<br><b>To:</b><span>=C2=A0</span>Carlos Lopez<br><b>Cc:</b><spa= n>=C2=A0</span><a href=3D"mailto:[email protected]" target=3D"_blank">zeek@zeek= .org</a><br><b>Subject:</b><span>=C2=A0</span>Re: [Zeek] Documentation abou= t Corelight's Splunk Apps for Zeek<span>=C2=A0</span><u></u><u></u></di= v><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Cal= ibri,sans-serif">=C2=A0<u></u><u></u></div></div></div><div><div><div style= =3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">= Hi Carlos,=C2=A0<u></u><u></u></div></div></div><div><div style=3D"margin:0= cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u>=C2= =A0<u></u></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:= 11pt;font-family:Calibri,sans-serif">As that is a Corelight offering and no= t something maintained by the Zeek Project or the community, we=E2=80=99d h= ave to refer you to Corelight.<u></u><u></u></div></div><div><div style=3D"= margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u><= /u>=C2=A0<u></u></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font= -size:11pt;font-family:Calibri,sans-serif">Let me find out who you need to = talk to and I=E2=80=99ll make introductions.=C2=A0<u></u><u></u></div></div= ><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Cali= bri,sans-serif"><u></u>=C2=A0<u></u></div></div><div><div style=3D"margin:0= cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Thanks,<u></= u><u></u></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:1= 1pt;font-family:Calibri,sans-serif">~Amber=C2=A0<u></u><u></u></div></div><= div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibr= i,sans-serif"><u></u>=C2=A0<u></u></div><div><div><div style=3D"margin:0cm = 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">On Fri, Dec 20,= 2019 at 3:56 AM Carlos Lopez <<a href=3D"mailto:[email protected]" sty= le=3D"color:blue;text-decoration:underline" target=3D"_blank">clopmz@outloo= k.com</a>> wrote:<u></u><u></u></div></div><blockquote style=3D"border-s= tyle:none none none solid;border-left-width:1pt;border-left-color:rgb(204,2= 04,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm"><div><d= iv><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri= ,sans-serif"><span lang=3D"EN-US">Hi all,</span><u></u><u></u></div><div st= yle=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-seri= f"><span lang=3D"EN-US">=C2=A0</span><u></u><u></u></div><div style=3D"marg= in:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span la= ng=3D"EN-US">I would like to install Corelight App For Splunk and TA for Co= relight, but there is no documentation about how to accomplish it =E2=80=A6= All info points to</span><a href=3D"https://www.corelight.com/support/" st= yle=3D"color:blue;text-decoration:underline" target=3D"_blank"><span lang= =3D"EN-US">https://www.corelight.com/support/</span></a><span lang=3D"EN-US= ">, but there is no docs in there =E2=80=A6</span><u></u><u></u></div><div = style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-se= rif"><span lang=3D"EN-US">=C2=A0</span><u></u><u></u></div><div style=3D"ma= rgin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span = lang=3D"EN-US">Any idea?</span><u></u><u></u></div></div></div><div><div><d= iv style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans= -serif"><span lang=3D"EN-US">=C2=A0</span><u></u><u></u></div><div style=3D= "margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><sp= an lang=3D"EN-US">=C2=A0</span><u></u><u></u></div><div style=3D"margin:0cm= 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"= EN-US">--=C2=A0</span><u></u><u></u></div><div><div style=3D"margin:0cm 0cm= 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"EN-U= S">Regards,</span><u></u><u></u></div></div><div style=3D"margin:0cm 0cm 0.= 0001pt;font-size:11pt;font-family:Calibri,sans-serif"><span lang=3D"EN-US">= C. L. Martinez</span><u></u><u></u></div></div></div><div style=3D"margin:0= cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">____________= ___________________________________<br>Zeek mailing list<br><a href=3D"mail= to:[email protected]" style=3D"color:blue;text-decoration:underline" target=3D"= _blank">[email protected]</a><br><a href=3D"http://mailman.icsi.berkeley.edu/ma= ilman/listinfo/zeek" style=3D"color:blue;text-decoration:underline" target= =3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><u></= u><u></u></div></blockquote></div></div><div style=3D"margin:0cm 0cm 0.0001= pt;font-size:11pt;font-family:Calibri,sans-serif">--<span>=C2=A0</span><u><= /u><u></u></div><div><div><div><div><div><div><div><div><div><div style=3D"= margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u><= /u>=C2=A0<u></u></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font= -size:11pt;font-family:Calibri,sans-serif"><b>Amber Graner</b><u></u><u></u= ></div></div><div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt= ;font-family:Calibri,sans-serif">Director of Community<u></u><u></u></div><= /div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:= Calibri,sans-serif">Corelight, Inc<u></u><u></u></div></div><div><div style= =3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">= <u></u>=C2=A0<u></u></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;= font-size:11pt;font-family:Calibri,sans-serif">828.582.9469<u></u><u></u></= div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-fa= mily:Calibri,sans-serif"><u></u>=C2=A0<u></u></div></div><div><div style=3D= "margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Sch= edule time on my calendar<span>=C2=A0</span><a href=3D"https://calendly.com= /amber_graner" style=3D"color:blue;text-decoration:underline" target=3D"_bl= ank">here.</a><u></u><u></u></div></div><div><div style=3D"margin:0cm 0cm 0= .0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u>=C2=A0<u></u>= </div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-= family:Calibri,sans-serif">=C2=A0=C2=A0<span style=3D"border:1pt solid wind= owtext;padding:0cm"><img border=3D"0" width=3D"96" height=3D"30" id=3D"gmai= l-m_-8102060181968517547_x0000_i1026" alt=3D"Image removed by sender." styl= e=3D"width: 1in; height: 0.3125in;"></span>=C2=A0<span style=3D"border:1pt = solid windowtext;padding:0cm"><img border=3D"0" width=3D"96" height=3D"39" = id=3D"gmail-m_-8102060181968517547_x0000_i1025" alt=3D"Image removed by sen= der." style=3D"width: 1in; height: 0.4062in;"></span><u></u><u></u></div></= div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-size:11pt;font-family:C= alibri,sans-serif"><u></u>=C2=A0<u></u></div></div><div><div style=3D"margi= n:0cm 0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">=C2=A0* A= sk me about how you can participate in the Zeek (formerly Bro) community.<u= ></u><u></u></div></div><div><div style=3D"margin:0cm 0cm 0.0001pt;font-siz= e:11pt;font-family:Calibri,sans-serif">=C2=A0* Remember - ZEEK AND YOU SHAL= L FIND!!</div></div></div></div></div></div></div></div></div></div></div><= /div></div></div></blockquote></div><br></div></div>_______________________= ________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div= dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"lt= r"><div><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"= ><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div d= ir=3D"ltr"><div dir=3D"ltr"><div><br></div><div><b>Patrick Kelley, CISSP, C= |EH, ITIL</b></div><div><i>CTO</i></div><div><a href=3D"mailto:patrick.kell= [email protected]" target=3D"_blank">patrick.kelley@criticalpaths= ecurity.com</a></div><div>(o) 770-224-6482</div></div></div></div></div></d= iv></div></div></div></div></div></div></div></div></div></div> --000000000000acbc55059a2396cf-- --===============2081733744== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============2081733744==--