[Bro] Bro +Splunk

Monah Baki monahbaki at gmail.com
Thu Nov 5 07:31:24 PST 2015


Hi Patrick,

http://www.splunk.com/en_us/download/universal-forwarder.html Can't foind a
link to download the universal forwarder. Is it free?

Thanks
Monah

On Thu, Nov 5, 2015 at 10:18 AM, Patrick Kelley <pkelley at hyperionavenue.com>
wrote:

> Yes!  Use the Splunk Universal Forwarder and monitor the
> "/usr/local/bro/logs/current" folder.  Make sure you configure Splunk to
> receive the data.   This can be done under settings.
>
> *Instructions*
>
> Install the forwarder -
>
> http://www.splunk.com/en_us/download/universal-forwarder.html
>
> Add the location of your Splunk server -
> ./splunk add forward-server 172.0.0.20:9997
>
> Add the monitor command -
> ./splunk add monitor //usr/local/bro/logs/current
>
> That's it.
>
> On Thu, Nov 5, 2015 at 4:52 AM, Monah Baki <monahbaki at gmail.com> wrote:
>
>> Hi all,
>>
>> Any good documentation for newbies as to how to send bro logs to a
>> remote splunk server?
>> What's the requirements on both sides and what files needs to be
>> touched on the bro to send the logs to the remote splunk server.
>> I know I installed from the splunk app the "Splunk add on for bro ids"
>>
>> Thanks
>> Monah
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>
>
>
>
> --
>
> Patrick Kelley, CEH
> Hyperion Avenue Labs
> http://www.hyperionavenue.com
> 951.291.8310
>
> *The limit to which you have accepted being comfortable is the limit to
> which you have grown. Accept new challenges as an opportunity to enrich
> yourself and not as a point of potential failure.*
>
> [image: hal_logo]
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20151105/bb95bece/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 12155 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20151105/bb95bece/attachment-0001.bin 


More information about the Bro mailing list