[Bro] Bro Kafka logging plugin
marcus at randomhack.org
Mon Aug 17 12:30:44 PDT 2015
Thanks for sharing Aaron. This is terrific.
On Fri, Aug 14, 2015 at 2:17 PM, Aaron Gee-Clough <lists at g-clef.net> wrote:
> I have a bro plugin that I've just finished writing that I'm hoping some
> folks will help test. It's a logging plugin that will send
> JSON-formatted bro logs to a Kafka message broker.
> The code is at: https://github.com/g-clef/KafkaLogger .
> Rather than writing a simple log forwarder, I modified things a bit:
> * You can specify which logs to send to Kafka in the bro config.
> * It will add a "type" field to the JSON message to clarify which
> the message came from ("http" vs "conn" vs "ssl", for example).
> * It will add a "sensor" field to the JSON message to allow you to
> logs from particular sensors in your network (if you have multiple bro
> sensors, you may want to be able to distinguish between logs from
> different sensors).
> * It will rename the "ts", "id.orig_h", "id.orig_p", "id.resp_h",
> "id.resp_p" fields to more commonly-used names (for example, "ts"
> becomes "@timestamp" to interoperate with logstash-style logs).
> The plugin is pretty young, so I would consider this beta testing at the
> moment. It is working and seems to be stable in my testing, but I'd love
> to have some other folks than me testing it.
> Feel free to send me questions or pull requests.
> Bro mailing list
> bro at bro-ids.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro