| Newsgroups |
gmane.comp.security.detection.bro |
| Message-ID |
<[email protected]> |
--===============1135017666==
Content-Type: multipart/alternative;
boundary="Apple-Mail=_16BA25AA-367C-4DD4-9309-2F4FD8C8A53E"
--Apple-Mail=_16BA25AA-367C-4DD4-9309-2F4FD8C8A53E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Cool, then that should work. Like I said, your environment and =
requirements will be unique and to adjust as needed. The entire guide =
is meant just as a way to help people get started. It=E2=80=99s not =
meant to be a one size fits all solution.
> On Dec 20, 2019, at 8:41 AM, Carlos Lopez <[email protected]> wrote:
>=20
> I agree with both of you. But this is a little lab to accomplish some =
tests using Splunk free version ( I don=E2=80=99t expect more than 500 =
MiB daily logs =F0=9F=98=8A).
> =20
> On the other side, Elastic is too expensive in maintenance and for me =
it is not an option in my case. With splunk things just work =F0=9F=98=8A
> =20
> --=20
> Regards,
> C. L. Martinez
> =20
> From: Patrick Kelley <[email protected] =
<mailto:[email protected]>>
> Date: Friday, 20 December 2019 at 15:35
> To: "[email protected] <mailto:[email protected]>" <[email protected] =
<mailto:[email protected]>>
> Cc: Carlos Lopez <[email protected] <mailto:[email protected]>>, =
"[email protected] <mailto:[email protected]>" <[email protected] =
<mailto:[email protected]>>
> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek
> =20
> Seconding the statements of Eric, Splunk costs can get to be expensive =
extremely quick with Zeek.=20
>=20
> My only secondary suggestion is that you ingest individual logs to =
provide a bit more granularity and control. You might not wish to =
ingest every log due to the processing and storage costs.
> =20
> In the past, I've tried leveraging Splunk multiple times due to my =
familiarity. In the end, we've built our stack around Elastic.=20
> =20
> We were just spending too much time servicing the hammer, instead of =
building the house.=20
> =20
> On Fri, Dec 20, 2019 at 9:29 AM [email protected] =
<mailto:[email protected]> <[email protected] =
<mailto:[email protected]>> wrote:
> Hi Carlos,
> =20
> =E2=80=9CBest=E2=80=9D is subjective. For someone who wants all logs =
and a short inputs.conf file, your suggestion will work. My example is =
geared towards the fact that these logs are large and depending on your =
Splunk license and requirements, you may not actually want to ingest =
every single log file into your system. Ultimately, you know your =
environment and needs best which is why I also state in the writeup:
> =20
> "An example inputs.conf is below but may or may not include the logs =
you wish to ingest...Modify the index and sourcetype configurations to =
your needs.=E2=80=9D
> =20
> Hope that helps!
> Eric
> =20
> On Dec 20, 2019, at 8:22 AM, Carlos Lopez <[email protected] =
<mailto:[email protected]>> wrote:
> =20
> Thanks Eric. But I have doubt with your setup. For inputs.conf, maybe =
this configuration is best?
> =20
> [monitor:///opt/zeek/logs/spool/current =
<monitor:///opt/zeek/logs/spool/current>]
> disabled =3D 0
> sourcetype =3D zeek:json
> whitelist =3D \.log$
> =20
> instead of to put file by file?
> --=20
> Regards,
> C. L. Martinez
> =20
> From: Eric Ooi <[email protected] <mailto:[email protected]>>
> Date: Friday, 20 December 2019 at 13:52
> To: Amber Graner <[email protected] =
<mailto:[email protected]>>, Carlos Lopez <[email protected] =
<mailto:[email protected]>>
> Cc: "[email protected] <mailto:[email protected]>" <[email protected] =
<mailto:[email protected]>>
> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek
> =20
> Assuming you=E2=80=99re doing an install on a standalone Splunk =
server, you can use my guide here: =
https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-t=
o-splunk/ =
<https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-=
to-splunk/>
> =20
> =20
> From: [email protected] <mailto:[email protected]> on behalf =
of Amber Graner <[email protected] <mailto:[email protected]>>
> Sent: Friday, December 20, 2019 6:13 AM
> To: Carlos Lopez
> Cc: [email protected] <mailto:[email protected]>
> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek=20
> =20
> Hi Carlos,=20
> =20
> As that is a Corelight offering and not something maintained by the =
Zeek Project or the community, we=E2=80=99d have to refer you to =
Corelight.
> =20
> Let me find out who you need to talk to and I=E2=80=99ll make =
introductions.=20
> =20
> Thanks,
> ~Amber=20
> =20
> On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <[email protected] =
<mailto:[email protected]>> wrote:
> Hi all,
> =20
> I would like to install Corelight App For Splunk and TA for Corelight, =
but there is no documentation about how to accomplish it =E2=80=A6 All =
info points tohttps://www.corelight.com/support/ =
<https://www.corelight.com/support/>, but there is no docs in there =E2=80=
=A6
> =20
> Any idea?
> =20
> =20
> --=20
> Regards,
> C. L. Martinez
> _______________________________________________
> Zeek mailing list
> [email protected] <mailto:[email protected]>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek =
<http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek>
> --=20
> =20
> Amber Graner
> Director of Community
> Corelight, Inc
> =20
> 828.582.9469
> =20
> Schedule time on my calendar here. <https://calendly.com/amber_graner>
> =20
> Error! Filename not specified. Error! Filename not specified.
> =20
> * Ask me about how you can participate in the Zeek (formerly Bro) =
community.
> * Remember - ZEEK AND YOU SHALL FIND!!
> =20
> _______________________________________________
> Zeek mailing list
> [email protected] <mailto:[email protected]>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek =
<http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek>
>=20
> =20
> --=20
> =20
> Patrick Kelley, CISSP, C|EH, ITIL
> CTO
> [email protected] =
<mailto:[email protected]>
> (o) 770-224-6482
--Apple-Mail=_16BA25AA-367C-4DD4-9309-2F4FD8C8A53E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Cool,=
then that should work. Like I said, your environment and requirements =
will be unique and to adjust as needed. The entire guide is meant =
just as a way to help people get started. It=E2=80=99s not meant =
to be a one size fits all solution.<br class=3D""><div><br =
class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Dec =
20, 2019, at 8:41 AM, Carlos Lopez <<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> =
wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><div =
class=3D"WordSection1" style=3D"page: WordSection1; caret-color: rgb(0, =
0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; =
font-variant-caps: normal; font-weight: normal; letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; =
text-decoration: none;"><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D"">I agree with both of you. But this is a little =
lab to accomplish some tests using Splunk free version ( I don=E2=80=99t =
expect more than 500 MiB daily logs<span =
class=3D"Apple-converted-space"> </span></span><span lang=3D"EN-US" =
style=3D"font-family: "Apple Color Emoji";" =
class=3D"">=F0=9F=98=8A</span><span lang=3D"EN-US" class=3D"">).<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""><o:p class=3D""> </o:p></span></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">On the =
other side, Elastic is too expensive in maintenance and for me it is not =
an option in my case. With splunk things just work<span =
class=3D"Apple-converted-space"> </span></span><span lang=3D"EN-US" =
style=3D"font-family: "Apple Color Emoji";" =
class=3D"">=F0=9F=98=8A</span><span lang=3D"EN-US" class=3D""><o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""><o:p class=3D""> </o:p></span></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">-- <o:p class=3D""></o:p></span></div><div class=3D""><div=
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">Regards,<o:p class=3D""></o:p></span></div></div></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">C. L. =
Martinez</span><span lang=3D"EN-US" class=3D""><o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""><o:p class=3D""> </o:p></span></div><div =
style=3D"border-style: solid none none; border-top-width: 1pt; =
border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><b class=3D""><span =
style=3D"font-size: 12pt;" class=3D"">From:<span =
class=3D"Apple-converted-space"> </span></span></b><span =
style=3D"font-size: 12pt;" class=3D"">Patrick Kelley <<a =
href=3D"mailto:[email protected]" style=3D"color: =
blue; text-decoration: underline;" =
class=3D"">[email protected]</a>><br =
class=3D""><b class=3D"">Date:<span =
class=3D"Apple-converted-space"> </span></b>Friday, 20 December =
2019 at 15:35<br class=3D""><b class=3D"">To:<span =
class=3D"Apple-converted-space"> </span></b>"<a =
href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: =
underline;" class=3D"">[email protected]</a>" <<a =
href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: =
underline;" class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Cc:<span =
class=3D"Apple-converted-space"> </span></b>Carlos Lopez <<a =
href=3D"mailto:[email protected]" style=3D"color: blue; =
text-decoration: underline;" class=3D"">[email protected]</a>>, "<a =
href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: =
underline;" class=3D"">[email protected]</a>" <<a =
href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: =
underline;" class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Subject:<span =
class=3D"Apple-converted-space"> </span></b>Re: [Zeek] =
Documentation about Corelight's Splunk Apps for Zeek<o:p =
class=3D""></o:p></span></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Seconding the statements of Eric, =
Splunk costs can get to be expensive extremely quick with Zeek. <br =
class=3D""><br class=3D"">My only secondary suggestion is that you =
ingest individual logs to provide a bit more granularity and =
control. You might not wish to ingest every log due to the =
processing and storage costs.<o:p class=3D""></o:p></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">In the past, I've tried leveraging Splunk multiple times due =
to my familiarity. In the end, we've built our stack around =
Elastic. <o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">We were just spending too much time servicing the hammer, =
instead of building the house. <o:p =
class=3D""></o:p></div></div></div><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D"">On Fri, Dec 20, 2019 at =
9:29 AM<span class=3D"Apple-converted-space"> </span><a =
href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: =
underline;" class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span><<a =
href=3D"mailto:[email protected]" style=3D"color: blue; text-decoration: =
underline;" class=3D"">[email protected]</a>> wrote:<o:p =
class=3D""></o:p></div></div><blockquote style=3D"border-style: none =
none none solid; border-left-width: 1pt; border-left-color: rgb(204, =
204, 204); padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: =
0cm;" class=3D""><div class=3D""><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Hi Carlos,<o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">=E2=80=9CBest=E2=80=9D is subjective. For someone who =
wants all logs and a short inputs.conf file, your suggestion will =
work. My example is geared towards the fact that these logs are =
large and depending on your Splunk license and requirements, you may not =
actually want to ingest every single log file into your system. =
Ultimately, you know your environment and needs best which is why I also =
state in the writeup:<o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">"An example inputs.conf is below but may or may not include =
the logs you wish to ingest...Modify the index and sourcetype =
configurations to your needs.=E2=80=9D<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Hope that helps!<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Eric<o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div =
class=3D""><blockquote style=3D"margin-top: 5pt; margin-bottom: 5pt;" =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D"">On Dec =
20, 2019, at 8:22 AM, Carlos Lopez <<a =
href=3D"mailto:[email protected]" target=3D"_blank" style=3D"color: =
blue; text-decoration: underline;" class=3D"">[email protected]</a>> =
wrote:<o:p class=3D""></o:p></div></div><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div><div class=3D""><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D"">Thanks Eric. But I have doubt with your setup. =
For inputs.conf, maybe this configuration is best?</span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D""> </span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" style=3D"font-size: 10pt; font-family: =
"Courier New";" class=3D"">[<a =
href=3D"monitor:///opt/zeek/logs/spool/current" style=3D"color: blue; =
text-decoration: underline;" =
class=3D"">monitor:///opt/zeek/logs/spool/current</a>]</span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" style=3D"font-size: 10pt; font-family: =
"Courier New";" class=3D"">disabled =3D 0</span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" style=3D"font-size: 10pt; font-family: =
"Courier New";" class=3D"">sourcetype =3D zeek:json</span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" style=3D"font-size: 10pt; font-family: =
"Courier New";" class=3D"">whitelist =3D \.log$</span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D""> </span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D"">instead of to put file by =
file?</span><o:p class=3D""></o:p></div></div><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">-- </span><o:p class=3D""></o:p></div></div><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D"">Regards,</span><o:p =
class=3D""></o:p></div></div></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">C. L. =
Martinez</span><o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D""> </span><o:p class=3D""></o:p></div></div><div =
style=3D"border-style: solid none none; border-top-width: 1pt; =
border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><b =
class=3D""><span style=3D"font-size: 12pt;" =
class=3D"">From: </span></b><span style=3D"font-size: 12pt;" =
class=3D"">Eric Ooi <<a href=3D"mailto:[email protected]" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Date: </b>Friday, 20 December 2019 at 13:52<br =
class=3D""><b class=3D"">To: </b>Amber Graner <<a =
href=3D"mailto:[email protected]" target=3D"_blank" style=3D"color: =
blue; text-decoration: underline;" =
class=3D"">[email protected]</a>>, Carlos Lopez <<a =
href=3D"mailto:[email protected]" target=3D"_blank" style=3D"color: =
blue; text-decoration: underline;" =
class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Cc: </b>"<a href=3D"mailto:[email protected]" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a>" <<a href=3D"mailto:[email protected]" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Subject: </b>Re: [Zeek] Documentation about Corelight's =
Splunk Apps for Zeek</span><o:p class=3D""></o:p></div></div></div><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Assuming you=E2=80=99re doing an install on a standalone =
Splunk server, you can use my guide here:<span =
class=3D"Apple-converted-space"> </span><a =
href=3D"https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-br=
o-logs-to-splunk/" target=3D"_blank" style=3D"color: blue; =
text-decoration: underline;" =
class=3D"">https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek=
-bro-logs-to-splunk/</a><o:p class=3D""></o:p></div></div></div></div><div=
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div></div><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D"MsoNormal" =
align=3D"center" style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif; text-align: center;"><hr size=3D"0" =
width=3D"84%" align=3D"center" class=3D""></div><div =
id=3D"gmail-m_-8102060181968517547divRplyFwdMsg" class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><b =
class=3D"">From:</b> <a href=3D"mailto:[email protected]" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a><span =
class=3D"Apple-converted-space"> </span>on behalf of Amber Graner =
<<a href=3D"mailto:[email protected]" target=3D"_blank" =
style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Sent:</b> Friday, December 20, 2019 6:13 AM<br =
class=3D""><b class=3D"">To:</b> Carlos Lopez<br class=3D""><b =
class=3D"">Cc:</b> <a href=3D"mailto:[email protected]" target=3D"_blank"=
style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a><br class=3D""><b =
class=3D"">Subject:</b> Re: [Zeek] Documentation about Corelight's =
Splunk Apps for Zeek <o:p class=3D""></o:p></div></div><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div></div><div class=3D""><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D"">Hi =
Carlos, <o:p class=3D""></o:p></div></div></div></div><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">As that is a Corelight offering and not =
something maintained by the Zeek Project or the community, we=E2=80=99d =
have to refer you to Corelight.<o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Let me find out who you need to talk to =
and I=E2=80=99ll make introductions. <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Thanks,<o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">~Amber <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div><div class=3D""><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D"">On Fri, Dec 20, 2019 at =
3:56 AM Carlos Lopez <<a href=3D"mailto:[email protected]" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a>> wrote:<o:p =
class=3D""></o:p></div></div></div><blockquote style=3D"border-style: =
none none none solid; border-left-width: 1pt; border-left-color: =
rgb(204, 204, 204); padding: 0cm 0cm 0cm 6pt; margin: 5pt 0cm 5pt =
4.8pt;" class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">Hi =
all,</span><o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D""> </span><o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">I would like to install Corelight App For Splunk and TA for =
Corelight, but there is no documentation about how to accomplish it =E2=80=
=A6 All info points to</span><a =
href=3D"https://www.corelight.com/support/" target=3D"_blank" =
style=3D"color: blue; text-decoration: underline;" class=3D""><span =
lang=3D"EN-US" =
class=3D"">https://www.corelight.com/support/</span></a><span =
lang=3D"EN-US" class=3D"">, but there is no docs in there =E2=80=A6</span>=
<o:p class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D""> </span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D"">Any idea?</span><o:p =
class=3D""></o:p></div></div></div></div><div class=3D""><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D""> </span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D"">-- </span><o:p =
class=3D""></o:p></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">Regards,</span><o:p class=3D""></o:p></div></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">C. L. Martinez</span><o:p =
class=3D""></o:p></div></div></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" =
class=3D"">_______________________________________________<br =
class=3D"">Zeek mailing list<br class=3D""><a =
href=3D"mailto:[email protected]" target=3D"_blank" style=3D"color: blue; =
text-decoration: underline;" class=3D"">[email protected]</a><br class=3D""><a=
href=3D"http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><o:p =
class=3D""></o:p></div></div></blockquote></div></div><div class=3D""><div=
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">-- <o:p =
class=3D""></o:p></div></div><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><b class=3D"">Amber Graner</b><o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D"">Director of Community<o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Corelight, Inc<o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">828.582.9469<o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Schedule time on my calendar <a =
href=3D"https://calendly.com/amber_graner" target=3D"_blank" =
style=3D"color: blue; text-decoration: underline;" =
class=3D"">here.</a><o:p class=3D""></o:p></div></div></div><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <b class=3D""><span =
lang=3D"EN-GB" style=3D"border: 1pt solid windowtext; padding: 0cm;" =
class=3D"">Error! Filename not specified.</span></b> <b =
class=3D""><span lang=3D"EN-GB" style=3D"border: 1pt solid windowtext; =
padding: 0cm;" class=3D"">Error! Filename not specified.</span></b><o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> * Ask me about how you can =
participate in the Zeek (formerly Bro) community.<o:p =
class=3D""></o:p></div></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> * Remember - ZEEK AND YOU SHALL =
FIND!!<o:p =
class=3D""></o:p></div></div></div></div></div></div></div></div></div></d=
iv></div></div></div></div></div></blockquote></div><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div></div></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" =
class=3D"">_______________________________________________<br =
class=3D"">Zeek mailing list<br class=3D""><a =
href=3D"mailto:[email protected]" target=3D"_blank" style=3D"color: blue; =
text-decoration: underline;" class=3D"">[email protected]</a><br class=3D""><a=
href=3D"http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><o:p =
class=3D""></o:p></div></blockquote></div><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><br clear=3D"all" class=3D""><o:p class=3D""></o:p></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">--<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><b class=3D"">Patrick Kelley, CISSP, C|EH, ITIL</b><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><i class=3D"">CTO</i><o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><a =
href=3D"mailto:[email protected]" target=3D"_blank" =
style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">(o) 770-224-6482<o:p =
class=3D""></o:p></div></div></div></div></div></div></div></div></div></d=
iv></div></div></div></div></div></div></div></div></div></blockquote></di=
v><br class=3D""></body></html>=
--Apple-Mail=_16BA25AA-367C-4DD4-9309-2F4FD8C8A53E--
--===============1135017666==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1135017666==--