Questions tagged [zeek]
105
questions
0
votes
0
answers
15
views
Simple zeek script
I am totally new to zeek scripting, and I am trying to to a very basic DNS tunnel detector.
Here is my code so far :
export {
const conn_packets_limit = 10;
const conn_time_limit = 30secs;
}
event ...
0
votes
0
answers
7
views
How to add geoIP in http logs of zeek?
I have used geoIP in zeek for resolving IPs in conn.log but I am unable to do the same for http and dns logs. Can anyone guide how to do so?
0
votes
0
answers
11
views
Zeek can't find spicy packet analyzer for snap
I wrote a packet analyzer and compiled it as aprt of zeek
This zeek script:
export {
## Default analyzer
const default_analyzer: PacketAnalyzer::Tag = PacketAnalyzer::ANALYZER_SNAPCDP &redef;
...
0
votes
0
answers
40
views
"netlink error: Operation not permitted" running Zeek on Docker
I'm running Zeek on a Docker container (from image Zeekurity) in standalone mode and I'm trying to disable checksum offloading for my network interface, but then this happens:
root@0787148fac96:/usr/...
0
votes
0
answers
15
views
Zeek Packet Analysis for all protocols
I realize Zeek is capable of analyzing packets for a specific protocol using the API. I want to be able to retrieve all packets without being specific to a protocol and create a packets.log type file ...
1
vote
0
answers
133
views
Kafka Connect to Cassandra Mapping Problem
While trying to push Zeek logs to Kafka (3.1.0) topics, which works fine and works as intended. Then I was trying writing them from Kafka to Cassandra (4.0.1) via the DataStax Apache Kafka® Connector (...
0
votes
0
answers
25
views
Zeek Vagrant setup
I have three vagrant machines, logger, host1 and host2. I have setup Zeek on logger VM. Host1 is running an apache server. Now I want Zeek to log the http traffic when I communicate with the apache ...
0
votes
1
answer
105
views
Trying to reproduce awk in jq
Preamble: Enterprise Network Engineer/Architect (Non-Programmer).
Synopsis: Logs moving from txt output to json
Issue: Not successfully trying to migrate from a functioning awk data extraction to ...
-1
votes
1
answer
137
views
Zeek (Bro) goes crashed after interface gets restarted
I have some issues with the zeek software. After the network interface eth0 gets restarted the zeekctl goes crashed. Is there any way of restart the zeekctl process automatically after a network ...
0
votes
0
answers
35
views
Process relaunched automatically after SIGTERM or SIGKILL
I try to write a python script that will start a process and whenever an event occur the script terminates the process and relaunches it again after a delay.
In order to stop the process I use kill -...
0
votes
0
answers
162
views
Zeek logs to elk
I've installed elk on server and zeek with filebeat on another server.
I followed documnetation to install each one, but the filebeat is not shipping zeek logs to kibana.
by the way filebeat basic ...
0
votes
1
answer
31
views
loading zeek connection data to pyflink
Trying to load data like this(zeek connection data) to pyflink. My problem is the id fields that have a name with a dot because they were originally a tuple in zeek.
{
"ts": 1584544201....
0
votes
1
answer
60
views
How to solve rule defined twice error in Zeek signature?
I'm trying to learn zeek signature
Signature file name: dns.sig
signature dns-intel{
ip-proto == udp
dst-port == 53
payload /.*life|.*bar/
event "[Suspicious DNS Query]" }
Zeek file ...
0
votes
1
answer
499
views
Zeek is not storing files, even after script was loaded. What am I missing?
I'm trying to configure Zeek in order to store files (every file) on disc, but without any success.
OS I'm using: Debian 10.
What I did so far:
I've installed this module: https://github.com/hosom/...
0
votes
1
answer
58
views
Zeek/Bro IDS - Sumstats - qty similarly sized TCP segments?
I'm trying to write my first script in Zeek which would allow to make statistics out of TLS packet segments sent and received by client in local network (quantity of packets with same size, list of ...
0
votes
1
answer
95
views
Zeek Workers cannot communicate with Zeek Proxy/manager
I set up a small zeek cluster and had it working fine. Here's my rough setup:
Proxy/Manager/Logger - 192.168.1.10
Worker-1 - 192.168.1.10 (em1)
Worker-2 - 192.168.1.15 (em1)
Worker-3 - 192.168.1.15 (...
0
votes
1
answer
256
views
How to set mmdb_dir in Zeek/Bro
I try to use GeoIp functionality in Bro/Zeek.
From the official Zeek Documentation:
If you see an error message similar to “Failed to open GeoIP location database”, then you may need to either ...
2
votes
1
answer
178
views
Error while installing Zeek-aux : Unknown CMake command "FindRequiredPackage"
I've downloaded the zeek-aux zipped source-code from 'https://github.com/zeek/zeek-aux'.
While comipiling i'm getting the following error.
'Unknown CMake command "FindRequiredPackage"'
Any help is ...
1
vote
1
answer
84
views
Does Zeek allow to inspect RTP headers?
Does Zeek allow to inspect RTP headers?
As far as I see here no RTP analizer has been added yet. So I have an another question regarding this topic. Is there any existing guide or tutorial explaining ...
0
votes
2
answers
1k
views
Zeek cluster fails with pcap_error: socket: Operation not permitted (pcap_activate)
I'm trying to setting up a Zeek IDS cluster (v.3.2.0-dev.271) on 3 Ubuntu 18.04 LTS hosts to no avail - running zeek deploy command fails with the following output:
fatal error: problem with ...
0
votes
1
answer
446
views
How to configure bro to ignore traffic from certain subnets?
Situation: I have set up a Zeek/Bro IDS and have it listen on one interface (with iptables forwarding traffic.
client1 === iptables === client2
||
zeek_ids
Problem: Zeek ...
0
votes
1
answer
279
views
Zeek Scripting "Error field missing value"
I'm trying to write a Zeek script to divide the dns traffic into two log files (query and reply)
The error is "Field missing value" for the code $TTL=c$dns$TTLs in dns_query_reply event.
I don't ...
1
vote
1
answer
80
views
Is it possible to inspect TCP reserved bits with Zeek?
I'm testing Zeek/Bro capabilities in terms of detecting different types of steganography. After working with the ICMP protocol now I am trying to inspect the TCP protocol. I want to detect if the ...
-3
votes
1
answer
135
views
Extract the Source IP Address from two different log samples with regex
I have a regular expression as follows:
"id.resp_h"|"rx_hosts":(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),
I am trying to extract the Source IP Address from two different log samples. "id.orig_h" and "...
0
votes
0
answers
677
views
Zeek missing loaded_scripts.log file
I am using Zeek standalone for the learning purpose and I am facing the following issues in the log file: I am missing the "loaded_scripts.log" file from the current folder. I have followed the ...
0
votes
1
answer
226
views
Zeek (Bro) rename log according to input file
I'm running zeek/bro on individual pcap files with the command line parameter -r inputfile.pcap. How can I access the file name of this input file in a bro script? I would like to rename the conn.log ...
1
vote
1
answer
2k
views
Steps for running a custom script in Zeek(bro) NSM and generating notice in log files?
I am a beginner with Zeek NSM. I have written a script that generates simply notice logs. I don't know where should I place this script or which steps should I follow to generate notice logs or my ...
1
vote
1
answer
347
views
Bro / Zeek broctl unable to find peers
After installation of Bro in cluster mode, peerstatus hangs, and only basic logs are generated, no traffic logs. No Conn log, or any others.
Log output below, I noticed no core file found in the ...
1
vote
1
answer
1k
views
Bro / Zeek debugging logs?
Is there anyway to see more debugging info with Bro / Zeek ?
Here's what I know of so far.
Logs on Manager, & workers (Stderr.log, Stdout.log)
broctl status
broctl diag
broctl print, & ...
1
vote
1
answer
411
views
Which services are identified in conn.log by Bro?
I am looking for the list of services that bro/zeek identifies in conn.log. But I am unable to find out exactly how many services Bro identifies. Where can I get the correct script le, source code or ...
0
votes
1
answer
406
views
Bro script for reading a list of Ips and domains
I am trying to read a file with a list of IP addresses and another one with domains, as a proof of concept of the Input Framework defined in https://docs.zeek.org/en/stable/frameworks/input.html
I´...
2
votes
0
answers
176
views
Missing logs in current folder
I am using security onion image 16.04.5.6.
I am new to Bro and according to this in current folder I should be albe to find http.logs file. However I only see :
loaded_scripts.log reporter.log ...
0
votes
1
answer
84
views
Where are built in scripts for identifying popular web applications?
I am investigating bro as a DPI solution to identify popular web applications (something like nDPI). I can identify that conn.log is analogous to netflow.
In the official documentation, it has been ...
0
votes
1
answer
552
views
Security Onion (Ubuntu 16.04) syslog-ng to multiple sources [closed]
I'm setting up Security Onion to play with Bro, but I want to send the logs to an additional SIEM in addition to ELK (which is installed on Security Onion by default). The wiki sends you here, which ...
0
votes
1
answer
56
views
Grok filter isn't matching to the bro httplog data
I am trying to use ELK to visualize the BRO log data. I found multiple grok filters online and it keeps failing to match the pattern to the data. One of the filters I tried using is:
grok {
...
0
votes
0
answers
326
views
BRO doesn't log ssh when user is found by PAM
Hydra's output using hydra -L ~/Documents/wordlists/Aliases.txt -P ~/Documents/wordlists/shortlist.txt -M servers.txt ssh -t 4 -V
sharp67 is a user in PAM and aaron1 is not.
[ATTEMPT] target 172....
2
votes
1
answer
74
views
How could BRO-IDS compare strings with NUL-terminator
I am testing string comparison with BRO, and got some runtime errors. Hope you guys could take a look and give me some hints.
For example i have two strings, let's say str_A and str_B, str_A is sort ...
0
votes
1
answer
405
views
Bro IDS signature_match trigger
I am new to BRO and just started to test signature on BRO. I have one script, main.bro, and a signature file, protosigs.sig. The idea is to compare the signature and do something within the rewritten ...