Re: Zeek with ELK

--===============1241305631==
Content-Type: multipart/alternative; boundary="000000000000423b82059b66b8be"

--000000000000423b82059b66b8be
Content-Type: text/plain; charset="UTF-8"

You should be able to fire up Elastic, Logstash and Kibana on FreeBSD,
using recommend Logstash configs to read in the log files from the file
system. I can check about the Filebeat port to see if that can be updated
or fixed.

I myself just use the CLI tools but have been working on something "Not
Java" to ingest log files into other than Splunk.


--
Michael Shirk
Daemon Security, Inc.
https://www.daemon-security.com

On Sun, Jan 5, 2020, 10:35 sec-x sec-x <[email protected]> wrote:

> Hi,
>
> I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic
> from TAP on the network) and i want to send all the logs to ELK in
> realtime.
>
> I saw Filebeat ports on BSD is old and has problems.
>
> How can i send the logs from the BSD to the Elastic (what is the
> correct/best way)?
>
>
> Thanks,
>
> CM.
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>

--000000000000423b82059b66b8be
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div>You should be able to fire up Elastic, Logstash and =
Kibana on FreeBSD, using recommend Logstash configs to read in the log file=
s from the file system. I can check about the Filebeat port to see if that =
can be updated or fixed.<div dir=3D"auto"><br></div><div dir=3D"auto">I mys=
elf just use the CLI tools but have been working on something &quot;Not Jav=
a&quot; to ingest log files into other than Splunk.<br><br><br><div data-sm=
artmail=3D"gmail_signature" dir=3D"auto">--<br>Michael Shirk<br>Daemon Secu=
rity, Inc.<br><a href=3D"https://www.daemon-security.com">https://www.daemo=
n-security.com</a></div></div><br><div class=3D"gmail_quote"><div dir=3D"lt=
r" class=3D"gmail_attr">On Sun, Jan 5, 2020, 10:35 sec-x sec-x &lt;<a href=
=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></d=
iv><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
I recently used zeek IDS on FreeBSD 12.1 - Default Policy (GetTraffic<br>
from TAP on the network) and i want to send all the logs to ELK in<br>
realtime.<br>
<br>
I saw Filebeat ports on BSD is old and has problems.<br>
<br>
How can i send the logs from the BSD to the Elastic (what is the<br>
correct/best way)?<br>
<br>
<br>
Thanks,<br>
<br>
CM.<br>
_______________________________________________<br>
Zeek mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"noreferrer">zeek@=
zeek.org</a><br>
<a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n=
oreferrer noreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/ma=
ilman/listinfo/zeek</a><br>
</blockquote></div></div></div>

--000000000000423b82059b66b8be--

--===============1241305631==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1241305631==--