| Newsgroups |
gmane.comp.security.detection.bro |
| Message-ID |
<[email protected]> |
--===============0539736153==
Content-Type: multipart/alternative;
boundary="Apple-Mail=_EC196D2D-DEF3-4A9C-8675-8236E97B531E"
--Apple-Mail=_EC196D2D-DEF3-4A9C-8675-8236E97B531E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Yep, definitely agree on the granularity and control. May also help with =
troubleshooting to split it out like that.
And Elastic is what I=E2=80=99m looking into next. :P
> On Dec 20, 2019, at 8:35 AM, Patrick Kelley =
<[email protected]> wrote:
>=20
> Seconding the statements of Eric, Splunk costs can get to be expensive =
extremely quick with Zeek.=20
>=20
> My only secondary suggestion is that you ingest individual logs to =
provide a bit more granularity and control. You might not wish to =
ingest every log due to the processing and storage costs.
>=20
> In the past, I've tried leveraging Splunk multiple times due to my =
familiarity. In the end, we've built our stack around Elastic.=20
>=20
> We were just spending too much time servicing the hammer, instead of =
building the house.=20
>=20
> On Fri, Dec 20, 2019 at 9:29 AM [email protected] =
<mailto:[email protected]> <[email protected] =
<mailto:[email protected]>> wrote:
> Hi Carlos,
>=20
> =E2=80=9CBest=E2=80=9D is subjective. For someone who wants all logs =
and a short inputs.conf file, your suggestion will work. My example is =
geared towards the fact that these logs are large and depending on your =
Splunk license and requirements, you may not actually want to ingest =
every single log file into your system. Ultimately, you know your =
environment and needs best which is why I also state in the writeup:
>=20
> "An example inputs.conf is below but may or may not include the logs =
you wish to ingest...Modify the index and sourcetype configurations to =
your needs.=E2=80=9D
>=20
> Hope that helps!
> Eric
>=20
>> On Dec 20, 2019, at 8:22 AM, Carlos Lopez <[email protected] =
<mailto:[email protected]>> wrote:
>>=20
>> Thanks Eric. But I have doubt with your setup. For inputs.conf, maybe =
this configuration is best?
>> =20
>> [monitor:///opt/zeek/logs/spool/current <>]
>> disabled =3D 0
>> sourcetype =3D zeek:json
>> whitelist =3D \.log$
>> =20
>> instead of to put file by file?
>> --=20
>> Regards,
>> C. L. Martinez
>> =20
>> From: Eric Ooi <[email protected] <mailto:[email protected]>>
>> Date: Friday, 20 December 2019 at 13:52
>> To: Amber Graner <[email protected] =
<mailto:[email protected]>>, Carlos Lopez <[email protected] =
<mailto:[email protected]>>
>> Cc: "[email protected] <mailto:[email protected]>" <[email protected] =
<mailto:[email protected]>>
>> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek
>> =20
>> Assuming you=E2=80=99re doing an install on a standalone Splunk =
server, you can use my guide here: =
https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-t=
o-splunk/ =
<https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-=
to-splunk/>
>> =20
>> =20
>> From: [email protected] <mailto:[email protected]> on behalf =
of Amber Graner <[email protected] <mailto:[email protected]>>
>> Sent: Friday, December 20, 2019 6:13 AM
>> To: Carlos Lopez
>> Cc: [email protected] <mailto:[email protected]>
>> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek=20
>> =20
>> Hi Carlos,=20
>> =20
>> As that is a Corelight offering and not something maintained by the =
Zeek Project or the community, we=E2=80=99d have to refer you to =
Corelight.
>> =20
>> Let me find out who you need to talk to and I=E2=80=99ll make =
introductions.=20
>> =20
>> Thanks,
>> ~Amber=20
>> =20
>> On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <[email protected] =
<mailto:[email protected]>> wrote:
>> Hi all,
>> =20
>> I would like to install Corelight App For Splunk and TA for =
Corelight, but there is no documentation about how to accomplish it =E2=80=
=A6 All info points tohttps://www.corelight.com/support/ =
<https://www.corelight.com/support/>, but there is no docs in there =E2=80=
=A6
>> =20
>> Any idea?
>> =20
>> =20
>> --=20
>> Regards,
>> C. L. Martinez
>> _______________________________________________
>> Zeek mailing list
>> [email protected] <mailto:[email protected]>
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek =
<http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek>
>> --=20
>> =20
>> Amber Graner
>> Director of Community
>> Corelight, Inc
>> =20
>> 828.582.9469
>> =20
>> Schedule time on my calendar here. =
<https://calendly.com/amber_graner>
>> =20
>> =20
>> =20
>> * Ask me about how you can participate in the Zeek (formerly Bro) =
community.
>> * Remember - ZEEK AND YOU SHALL FIND!!
>=20
> _______________________________________________
> Zeek mailing list
> [email protected] <mailto:[email protected]>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek =
<http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek>
>=20
> --=20
>=20
> Patrick Kelley, CISSP, C|EH, ITIL
> CTO
> [email protected] =
<mailto:[email protected]>
> (o) 770-224-6482
--Apple-Mail=_EC196D2D-DEF3-4A9C-8675-8236E97B531E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Yep, =
definitely agree on the granularity and control. May also help with =
troubleshooting to split it out like that.<div class=3D""><br =
class=3D""></div><div class=3D"">And Elastic is what I=E2=80=99m looking =
into next. :P<br class=3D""><div><br class=3D""><blockquote type=3D"cite" =
class=3D""><div class=3D"">On Dec 20, 2019, at 8:35 AM, Patrick Kelley =
<<a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>> =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
dir=3D"ltr" class=3D"">Seconding the statements of Eric, Splunk costs =
can get to be expensive extremely quick with Zeek. <br class=3D""><br=
class=3D"">My only secondary suggestion is that you ingest individual =
logs to provide a bit more granularity and control. You might not =
wish to ingest every log due to the processing and storage costs.<div =
class=3D""><br class=3D""></div><div class=3D"">In the past, I've tried =
leveraging Splunk multiple times due to my familiarity. In the =
end, we've built our stack around Elastic. </div><div class=3D""><br =
class=3D""></div><div class=3D"">We were just spending too much time =
servicing the hammer, instead of building the =
house. </div></div><br class=3D""><div class=3D"gmail_quote"><div =
dir=3D"ltr" class=3D"gmail_attr">On Fri, Dec 20, 2019 at 9:29 AM <a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a> =
<<a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>> wrote:<br =
class=3D""></div><blockquote class=3D"gmail_quote" style=3D"margin:0px =
0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: =
break-word;" class=3D""><div class=3D"">Hi Carlos,</div><div =
class=3D""><br class=3D""></div><div class=3D"">=E2=80=9CBest=E2=80=9D =
is subjective. For someone who wants all logs and a short =
inputs.conf file, your suggestion will work. My example is geared =
towards the fact that these logs are large and depending on your Splunk =
license and requirements, you may not actually want to ingest every =
single log file into your system. Ultimately, you know your =
environment and needs best which is why I also state in the =
writeup:</div><div class=3D""><br class=3D""></div><div class=3D"">"An =
example inputs.conf is below but may or may not include the logs you =
wish to ingest...Modify the index and sourcetype configurations to your =
needs.=E2=80=9D</div><div class=3D""><br class=3D""></div><div =
class=3D"">Hope that helps!</div><div class=3D"">Eric</div><div =
class=3D""><br class=3D""></div><div class=3D""><div =
class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Dec =
20, 2019, at 8:22 AM, Carlos Lopez <<a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a>> wrote:</div><br class=3D""><div =
class=3D""><div =
style=3D"font-family:Helvetica;font-size:12px;font-style:normal;font-varia=
nt-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;t=
ext-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;tex=
t-decoration:none" class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">Thanks Eric. But I have doubt with your setup. =
For inputs.conf, maybe this configuration is best?<u class=3D""></u><u =
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""><u class=3D""></u> <u =
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" style=3D"font-size:10pt;font-family:"Courier =
New"" class=3D"">[<a style=3D"color:blue;text-decoration:underline" =
class=3D"">monitor:///opt/zeek/logs/spool/current</a>]<u class=3D""></u><u=
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" style=3D"font-size:10pt;font-family:"Courier =
New"" class=3D"">disabled =3D 0<u class=3D""></u><u =
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" style=3D"font-size:10pt;font-family:"Courier =
New"" class=3D"">sourcetype =3D zeek:json<u class=3D""></u><u =
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" style=3D"font-size:10pt;font-family:"Courier =
New"" class=3D"">whitelist =3D \.log$<u class=3D""></u><u =
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""><u class=3D""></u> <u =
class=3D""></u></span></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">instead of to put file by file?<u =
class=3D""></u><u class=3D""></u></span></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">-- <u class=3D""></u><u =
class=3D""></u></span></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">Regards,<u class=3D""></u><u =
class=3D""></u></span></div></div></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">C. L. Martinez</span><span lang=3D"EN-US" =
class=3D""><u class=3D""></u><u class=3D""></u></span></div><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""><u class=3D""></u> <u =
class=3D""></u></span></div><div style=3D"border-style:solid none =
none;border-top-width:1pt;border-top-color:rgb(181,196,223);padding:3pt =
0cm 0cm" class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><b =
class=3D""><span style=3D"font-size:12pt" class=3D"">From:<span =
class=3D""> </span></span></b><span style=3D"font-size:12pt" =
class=3D"">Eric Ooi <<a href=3D"mailto:[email protected]" =
target=3D"_blank" class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Date:<span class=3D""> </span></b>Friday, 20 December =
2019 at 13:52<br class=3D""><b class=3D"">To:<span =
class=3D""> </span></b>Amber Graner <<a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a>>, Carlos Lopez <<a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a>><br class=3D""><b class=3D"">Cc:<span=
class=3D""> </span></b>"<a href=3D"mailto:[email protected]" =
target=3D"_blank" class=3D"">[email protected]</a>" <<a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a>><br class=3D""><b class=3D"">Subject:<span=
class=3D""> </span></b>Re: [Zeek] Documentation about Corelight's =
Splunk Apps for Zeek<u class=3D""></u><u =
class=3D""></u></span></div></div><div class=3D""><div style=3D"margin:0cm=
0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u=
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">Assuming you=E2=80=99re doing an install on a standalone =
Splunk server, you can use my guide here: <a =
href=3D"https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-br=
o-logs-to-splunk/" target=3D"_blank" =
class=3D"">https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek=
-bro-logs-to-splunk/</a><u class=3D""></u><u =
class=3D""></u></div></div></div><div class=3D""><div style=3D"margin:0cm =
0cm 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D""> <u class=3D""></u><u class=3D""></u></div></div><div =
class=3D"MsoNormal" align=3D"center" style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif;text-align:center">=
<hr size=3D"0" width=3D"100%" align=3D"center" class=3D""></div><div =
id=3D"gmail-m_-8102060181968517547divRplyFwdMsg" class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><b =
class=3D"">From:</b><span class=3D""> </span><a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a> on behalf of Amber Graner <<a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Sent:</b><span class=3D""> </span>Friday, December 20, =
2019 6:13 AM<br class=3D""><b class=3D"">To:</b><span =
class=3D""> </span>Carlos Lopez<br class=3D""><b =
class=3D"">Cc:</b><span class=3D""> </span><a =
href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a><br class=3D""><b class=3D"">Subject:</b><span=
class=3D""> </span>Re: [Zeek] Documentation about Corelight's =
Splunk Apps for Zeek<span class=3D""> </span><u class=3D""></u><u =
class=3D""></u></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D""> <u class=3D""></u><u =
class=3D""></u></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D"">Hi =
Carlos, <u class=3D""></u><u class=3D""></u></div></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D"">As =
that is a Corelight offering and not something maintained by the Zeek =
Project or the community, we=E2=80=99d have to refer you to Corelight.<u =
class=3D""></u><u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D"">Let =
me find out who you need to talk to and I=E2=80=99ll make =
introductions. <u class=3D""></u><u class=3D""></u></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">Thanks,<u class=3D""></u><u class=3D""></u></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">~Amber <u class=3D""></u><u =
class=3D""></u></div></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div><div class=3D""><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D"">On =
Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <<a =
href=3D"mailto:[email protected]" =
style=3D"color:blue;text-decoration:underline" target=3D"_blank" =
class=3D"">[email protected]</a>> wrote:<u class=3D""></u><u =
class=3D""></u></div></div><blockquote style=3D"border-style:none none =
none =
solid;border-left-width:1pt;border-left-color:rgb(204,204,204);padding:0cm=
0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm" class=3D""><div =
class=3D""><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">Hi all,</span><u class=3D""></u><u =
class=3D""></u></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><u class=3D""></u><u =
class=3D""></u></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">I would like to install Corelight App For =
Splunk and TA for Corelight, but there is no documentation about how to =
accomplish it =E2=80=A6 All info points to</span><a =
href=3D"https://www.corelight.com/support/" =
style=3D"color:blue;text-decoration:underline" target=3D"_blank" =
class=3D""><span lang=3D"EN-US" =
class=3D"">https://www.corelight.com/support/</span></a><span =
lang=3D"EN-US" class=3D"">, but there is no docs in there =E2=80=A6</span>=
<u class=3D""></u><u class=3D""></u></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><u class=3D""></u><u =
class=3D""></u></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">Any idea?</span><u class=3D""></u><u =
class=3D""></u></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><u class=3D""></u><u =
class=3D""></u></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><u class=3D""></u><u =
class=3D""></u></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">-- </span><u class=3D""></u><u =
class=3D""></u></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">Regards,</span><u class=3D""></u><u =
class=3D""></u></div></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><span =
lang=3D"EN-US" class=3D"">C. L. Martinez</span><u class=3D""></u><u =
class=3D""></u></div></div></div><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">_______________________________________________<br =
class=3D"">Zeek mailing list<br class=3D""><a =
href=3D"mailto:[email protected]" =
style=3D"color:blue;text-decoration:underline" target=3D"_blank" =
class=3D"">[email protected]</a><br class=3D""><a =
href=3D"http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" =
style=3D"color:blue;text-decoration:underline" target=3D"_blank" =
class=3D"">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><u =
class=3D""></u><u class=3D""></u></div></blockquote></div></div><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D"">--<span=
class=3D""> </span><u class=3D""></u><u class=3D""></u></div><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><b =
class=3D"">Amber Graner</b><u class=3D""></u><u =
class=3D""></u></div></div><div class=3D""><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">Director of Community<u class=3D""></u><u =
class=3D""></u></div></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">Corelight, Inc<u class=3D""></u><u =
class=3D""></u></div></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">828.582.9469<u class=3D""></u><u =
class=3D""></u></div></div><div class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D"">Schedule time on my calendar<span class=3D""> </span><a =
href=3D"https://calendly.com/amber_graner" =
style=3D"color:blue;text-decoration:underline" target=3D"_blank" =
class=3D"">here.</a><u class=3D""></u><u class=3D""></u></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" =
class=3D""> <span style=3D"border:1pt solid =
windowtext;padding:0cm" class=3D""><img border=3D"0" width=3D"96" =
height=3D"30" id=3D"gmail-m_-8102060181968517547_x0000_i1026" alt=3D"Image=
removed by sender." style=3D"width: 1in; height: 0.3125in;" =
class=3D""></span> <span style=3D"border:1pt solid =
windowtext;padding:0cm" class=3D""><img border=3D"0" width=3D"96" =
height=3D"39" id=3D"gmail-m_-8102060181968517547_x0000_i1025" alt=3D"Image=
removed by sender." style=3D"width: 1in; height: 0.4062in;" =
class=3D""></span><u class=3D""></u><u class=3D""></u></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""><u =
class=3D""></u> <u class=3D""></u></div></div><div class=3D""><div =
style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""> *=
Ask me about how you can participate in the Zeek (formerly Bro) =
community.<u class=3D""></u><u class=3D""></u></div></div><div =
class=3D""><div style=3D"margin:0cm 0cm =
0.0001pt;font-size:11pt;font-family:Calibri,sans-serif" class=3D""> *=
Remember - ZEEK AND YOU SHALL =
FIND!!</div></div></div></div></div></div></div></div></div></div></div></=
div></div></div></blockquote></div><br =
class=3D""></div></div>_______________________________________________<br =
class=3D"">
Zeek mailing list<br class=3D"">
<a href=3D"mailto:[email protected]" target=3D"_blank" =
class=3D"">[email protected]</a><br class=3D"">
<a href=3D"http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" =
rel=3D"noreferrer" target=3D"_blank" =
class=3D"">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blo=
ckquote></div><br clear=3D"all" class=3D""><div class=3D""><br =
class=3D""></div>-- <br class=3D""><div dir=3D"ltr" =
class=3D"gmail_signature"><div dir=3D"ltr" class=3D""><div class=3D""><div=
dir=3D"ltr" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div =
dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" =
class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div =
dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D""><div dir=3D"ltr" =
class=3D""><div dir=3D"ltr" class=3D""><div class=3D""><br =
class=3D""></div><div class=3D""><b class=3D"">Patrick Kelley, CISSP, =
C|EH, ITIL</b></div><div class=3D""><i class=3D"">CTO</i></div><div =
class=3D""><a href=3D"mailto:[email protected]" =
target=3D"_blank" =
class=3D"">[email protected]</a></div><div =
class=3D"">(o) =
770-224-6482</div></div></div></div></div></div></div></div></div></div></=
div></div></div></div></div></div>
</div></blockquote></div><br class=3D""></div></body></html>=
--Apple-Mail=_EC196D2D-DEF3-4A9C-8675-8236E97B531E--
--===============0539736153==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0539736153==--