MolochON 2019 Leveraging Zeek Logs in Moloch with Filebeat and Logstash - Seth Grover

Arkime (formerly Moloch) is a large scale, open source, full packet capturing, indexing, and database system - arkime.com. Zeek logs can be used in Arkime alongside regular Arkime session records to increase visibility into the other protocol parsers the Zeek framework provides. I'll use Malcolm to illustrate how Filebeat and Logstash can be used to forward, parse, and normalize Zeek logs so they can be searched in Moloch. I'll also show how Zeek logs and Arkime sessions can be correlated using things like community ID, JA3, etc.

Видео MolochON 2019 Leveraging Zeek Logs in Moloch with Filebeat and Logstash - Seth Grover автора Алгоритмическая Фрактальность