[Zeek] Documentation about Corelight's Splunk Apps for Zeek

[Patrick Kelley]

Seconding the statements of Eric, Splunk costs can get to be expensive
extremely quick with Zeek.

My only secondary suggestion is that you ingest individual logs to provide
a bit more granularity and control.  You might not wish to ingest every log
due to the processing and storage costs.

In the past, I've tried leveraging Splunk multiple times due to my
familiarity.  In the end, we've built our stack around Elastic.

We were just spending too much time servicing the hammer, instead of
building the house.

On Fri, Dec 20, 2019 at 9:29 AM ericooi at gmail.com <ericooi at gmail.com> wrote:

> Hi Carlos,
>
> “Best” is subjective.  For someone who wants all logs and a short
> inputs.conf file, your suggestion will work.  My example is geared towards
> the fact that these logs are large and depending on your Splunk license and
> requirements, you may not actually want to ingest every single log file
> into your system.  Ultimately, you know your environment and needs best
> which is why I also state in the writeup:
>
> "An example inputs.conf is below but may or may not include the logs you
> wish to ingest...Modify the index and sourcetype configurations to your
> needs.”
>
> Hope that helps!
> Eric
>
> On Dec 20, 2019, at 8:22 AM, Carlos Lopez <clopmz at outlook.com> wrote:
>
> Thanks Eric. But I have doubt with your setup. For inputs.conf, maybe this
> configuration is best?
>
> [monitor:///opt/zeek/logs/spool/current]
> disabled = 0
> sourcetype = zeek:json
> whitelist = \.log$
>
> instead of to put file by file?
> --
> Regards,
> C. L. Martinez
>
> *From: *Eric Ooi <ericooi at gmail.com>
> *Date: *Friday, 20 December 2019 at 13:52
> *To: *Amber Graner <akgraner at corelight.com>, Carlos Lopez <
> clopmz at outlook.com>
> *Cc: *"zeek at zeek.org" <zeek at zeek.org>
> *Subject: *Re: [Zeek] Documentation about Corelight's Splunk Apps for Zeek
>
> Assuming you’re doing an install on a standalone Splunk server, you can
> use my guide here:
> https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-to-splunk/
>
>
> ------------------------------
> *From:* zeek-bounces at zeek.org on behalf of Amber Graner <
> akgraner at corelight.com>
> *Sent:* Friday, December 20, 2019 6:13 AM
> *To:* Carlos Lopez
> *Cc:* zeek at zeek.org
> *Subject:* Re: [Zeek] Documentation about Corelight's Splunk Apps for Zeek
>
>
> Hi Carlos,
>
> As that is a Corelight offering and not something maintained by the Zeek
> Project or the community, we’d have to refer you to Corelight.
>
> Let me find out who you need to talk to and I’ll make introductions.
>
> Thanks,
> ~Amber
>
> On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <clopmz at outlook.com> wrote:
>
> Hi all,
>
> I would like to install Corelight App For Splunk and TA for Corelight, but
> there is no documentation about how to accomplish it … All info points to
> https://www.corelight.com/support/, but there is no docs in there …
>
> Any idea?
>
>
> --
> Regards,
> C. L. Martinez
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
> <http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek>
>
> --
>
> *Amber Graner*
> Director of Community
> Corelight, Inc
>
> 828.582.9469
>
> Schedule time on my calendar here. <https://calendly.com/amber_graner>
>
>   [image: Image removed by sender.] [image: Image removed by sender.]
>
>  * Ask me about how you can participate in the Zeek (formerly Bro)
> community.
>  * Remember - ZEEK AND YOU SHALL FIND!!
>
>
> _______________________________________________
> Zeek mailing list
> zeek at zeek.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



-- 

*Patrick Kelley, CISSP, C|EH, ITIL*
*CTO*
patrick.kelley at criticalpathsecurity.com
(o) 770-224-6482
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20191220/a5d306ca/attachment.html