<div><div dir="auto">Apologies as this isn’t the question you asked - but are you able to use a file reader agent that can output to Sysmon? There is a plugin option for Fluentd, and a syslog server like Syslogng can read from file and forward. May be other options as well. </div><div dir="auto"><br></div><div>On Wed, Jun 24, 2020 at 4:55 AM Scot Harris <<a href="mailto:SHARRIS@hollywoodfl.org" target="_blank">SHARRIS@hollywoodfl.org</a>> wrote:<br></div><div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Does zeek have support to send syslog events?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Looked in the logger and notice frameworks but did not see anything there.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Documentation has a fair amount about ingesting syslog messages but nothing about outputting them.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Running zeek 3.1.1 currently.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Wanted to be able to send certain events such as SSH password guessing events to a syslog server which can open tickets on such events.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Guessing would need to add another type to the logger framework with config items in zeekctl.cfg for the syslog server address.<u></u><u></u></p>
<p class="MsoNormal">And use logger –n with that option to send the message to the specific host.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Ideas?<u></u><u></u></p>
</div>
</div>
_______________________________________________<br>
Zeek mailing list<br>
<a href="mailto:zeek@zeek.org" target="_blank">zeek@zeek.org</a><br>
<a href="http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel="noreferrer" target="_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a></blockquote></div></div>
</div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Darren Spruell<br><a href="mailto:phatbuckett@gmail.com">phatbuckett@gmail.com</a></div>