What is zeek2es.py
SysmonSearch makes event log analysis more effective by aggregating Microsoft Sysmon logs and providing detailed analysis through Elasticsearch and Kibana.
This Python Application Translates Zeek's Logs into ElasticSearch Format
This Python application converts Zeek's ASCII TSV and JSON logs into the bulk load JSON format used by ElasticSearch. Table of Contents: - Introduction - Installation - Elastic v8.0+ - Docker - Upgrading zeek2es - ES Ingest Pipeline - Filtering Data - Python Filters - Filter on Keys - Command Line Examples - Command Line Options - Requirements - Notes - Humio JSON Log Input - Data Streams - Helper Scripts - Cython Introduction Would you like to view multiple Zeek logs for the same connection ID (uid) or file ID (fuid)? Here are the results from files.log, http.log, and conn.log for a single uid: You can perform subnet searching using Zeek's 'addr' type: You can create time series graphs, such as this graph for NTP and HTTP: IP addresses can be geolocated using the -g command line option: Aggregations are straightforward and efficient: This application is designed to function seamlessly even when Zeek log formats change.
Understanding Field Names and Mappings in ElasticSearch
The logic processes the field names along with their associated types to ensure that the mappings are set up correctly in ElasticSearch.
This application can identify gzip and uncompressed logs
This application can recognize both gzip-compressed logs and uncompressed logs.
This application assumes you have ElasticSearch configured
This application assumes that you have ElasticSearch installed and running on your localhost, using the default port. If you do not have ElasticSearch, you can still output the JSON to stdout by using the -s -b command line options.
zeek2es.py Reviews
No reviews yet.
