Re: Zeek with ELK
Patrick Kelley <[email protected]> Sun, 5 Jan 2020 11:00:16 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
--===============1240445103== Content-Type: multipart/alternative; boundary=Apple-Mail-DFE17DC1-E89B-48F2-BFF2-5672B5E8F4F9 Content-Transfer-Encoding: 7bit --Apple-Mail-DFE17DC1-E89B-48F2-BFF2-5672B5E8F4F9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Logstash is the best option. http://thegreyblog.blogspot.com/2014/01/installing-logstash-on-freebsd.html?= m=3D1 Patrick Kelley, CISSP, C|EH, ITIL CTO [email protected] > On Jan 5, 2020, at 10:35 AM, sec-x sec-x <[email protected]> wrote: >=20 > =EF=BB=BFHi, >=20 > I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic > from TAP on the network) and i want to send all the logs to ELK in > realtime. >=20 > I saw Filebeat ports on BSD is old and has problems. >=20 > How can i send the logs from the BSD to the Elastic (what is the > correct/best way)? >=20 >=20 > Thanks, >=20 > CM. > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --Apple-Mail-DFE17DC1-E89B-48F2-BFF2-5672B5E8F4F9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto">Logstash is the best option.<div><br></div>= <div><a href=3D"http://thegreyblog.blogspot.com/2014/01/installing-logstash-= on-freebsd.html?m=3D1">http://thegreyblog.blogspot.com/2014/01/installing-lo= gstash-on-freebsd.html?m=3D1</a><br><br><div dir=3D"ltr"><div><b style=3D"ba= ckground-color: rgba(255, 255, 255, 0);">Patrick Kelley, CISSP, C|EH, ITIL</= b></div><div><i>CTO</i></div><div><font color=3D"#000000" style=3D"backgroun= d-color: rgba(255, 255, 255, 0);"><a href=3D"mailto:patrick.kelley@criticalp= athsecurity.com" target=3D"_blank" style=3D"background-color: rgba(255, 255,= 255, 0);">[email protected]</a></font></div><div><br>= </div><div><span style=3D"background-color: rgba(255, 255, 255, 0);"><img sr= c=3D"https://docs.google.com/uc?export=3Ddownload&id=3D14A5_m49pLX4F6JEP= VhLf902vExNmV5OA&revid=3D0B7inYJ_Q8hDQbnNTRzhtaUNCMHlVeld5RXREWWFjTjU4MH= VzPQ" width=3D"96" height=3D"96" data-unique-identifier=3D""></span></div><d= iv><span style=3D"background-color: rgba(255, 255, 255, 0);"><br></span></di= v></div><div dir=3D"ltr"><br><blockquote type=3D"cite">On Jan 5, 2020, at 10= :35 AM, sec-x sec-x <[email protected]> wrote:<br><br></blockquote>= </div><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF<span>Hi,</span><b= r><span></span><br><span>I recently used zeek IDS on FreeBSD 12.1 - Default P= olicy (GetTraffic</span><br><span>from TAP on the network) and i want to sen= d all the logs to ELK in</span><br><span>realtime.</span><br><span></span><b= r><span>I saw Filebeat ports on BSD is old and has problems.</span><br><span= ></span><br><span>How can i send the logs from the BSD to the Elastic (what i= s the</span><br><span>correct/best way)?</span><br><span></span><br><span></= span><br><span>Thanks,</span><br><span></span><br><span>CM.</span><br><span>= _______________________________________________</span><br><span>Zeek mailing= list</span><br><span>[email protected]</span><br><span>http://mailman.ICSI.Berk= eley.EDU/mailman/listinfo/zeek</span><br></div></blockquote></div></body></h= tml>= --Apple-Mail-DFE17DC1-E89B-48F2-BFF2-5672B5E8F4F9-- --===============1240445103== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1240445103==--