[Bro] filebeat +elk

Michał Purzyński michalpurzynski1 at gmail.com
Wed Mar 28 10:52:39 PDT 2018


Sending details outside of the mailing list is not cool and against what the open source community stands for.

Anyway, we’ve had a great success with taking Bro JSON logs and shipping them over to RabbitMQ with syslog-ng (no parsing done on the syslog-ng side) and fetching those with MozDef workers (which are python).

6k eps no sweat.


> On Mar 28, 2018, at 10:28 AM, Patrick Kelley <pkelley at hyperionavenue.com> wrote:
> 
> Erik,
> 
> I’m doing this with Ubuntu and Pi devices. I’ll send you all of my notes outside of the main channel.
> 
> Patrick Kelley, CISSP, C|EH, ITIL
> Principal Security Engineer
> patrick.kelley at criticalpathsecurity.com
> 
> 
>> On Mar 28, 2018, at 1:09 PM, Zeolla at GMail.com <zeolla at gmail.com> wrote:
>> 
>> Do you specifically need to send it to logstash or do you just need it to get inserted into elasticsearch?
>> 
>> Jon
>> 
>>> On Wed, Mar 28, 2018 at 1:07 PM erik clark <philosnef at gmail.com> wrote:
>>> I am trying to ingest bro 2.5 json logs into an elk stack, using filebeat to push the logs. Is that even the best way to do this? I have found MUCH outdated material on ingesting bro logs into an elk stack, but very little that is up to date, and some of which is up to date but is using older versions of software from elastic.co. If anyone has a modern bro/elk integration document they use(d) to set their environment up, it would be greatly appreciated if you could share. Thanks!
>>> 
>>> Erik
>>> _______________________________________________
>>> Bro mailing list
>>> bro at bro-ids.org
>>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>> -- 
>> Jon
>> 
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180328/2691b3b3/attachment.html 


More information about the Bro mailing list