TA for Zeek
Overview
Details
Corelight Add-on for Zeek Documentation
The TA for Zeek allows a Splunk Enterprise administrator to parse open source Zeek data in JSON or TSV format, and map it into the Common Information Model for use by multiple Splunk security apps.
About Corelight Add-on for Zeek
| Author | Aplura, LLC |
| App Version | 1.0.8 |
| App Build | 14 |
| Creates an index | False |
| Implements summarization | No |
| Summary Indexing | False |
| Data Model Acceleration | None |
| Report Acceleration | None |
| Splunk Enterprise versions | 9.x, 8.x |
| Platforms | Splunk Enterprise |
Scripts and binaries
This App provides the following scripts:
- None
Overview
Lookups
Corelight Add-on for Zeek contains the following lookup files.
-
bro_conn_state.csv
-
bro_note_alert_type.csv
-
bro_protocols.csv
-
bro_status_action.csv
-
bro_tc_flag.csv
-
bro_vendor_info.csv
Event Generator
Corelight Add-on for Zeek does not include an event generator.
Acceleration
-
Summary Indexing: No
-
Data Model Acceleration: No
-
Report Acceleration: No
binary file declaration
- None
Release Notes
Version 1.0.8
-
Bug
-
[DESK-1539] - Updated
props.confforzeek:filesto remove an incorrect evaluator (!==) from an eval statement.
Version 1.0.7
-
Bug
-
[DESK-1537] - Updated
props.confforzeek:sslto include the proper lookup definition.
Version 1.0.6
- CIM Updates for v5.2
Release Notes
Version 1.0.8
- Bug
- [DESK-1539] - Updated
props.confforzeek:filesto remove an incorrect evaluator (!==) from an eval statement.
Version 1.0.7
Version 1.0.7
- Bug
- [DESK-1537] - Updated
props.confforzeek:sslto include the proper lookup definition.
Version 1.0.6
Version 1.0.6
- CIM Updates
- Improvement in Zeek log parsing and knowledge.
Version 1.0.5
Fixed a bug in the mapping of the dest_port field
Version 1.0.4
Add DNS field mappings for improved Enterprise Security/CIM functionality
Version 1.0.3
Added new FIELDALIAS values per field request
Version 1.0.2
Add several FIELDALIAS items for CIM mapping, as well as event types that make the data render better within the Corelight App for Splunk.
Version 1.0.1
Minor bug fixes
Version 1.0.0
• Updated “action” field to produce values in line with the Network Traffic data model, including removing the mappings for actions from the notice log.
• Moved several fields from global declarations to local ones based on where the data will actually be present:
◦ attachment_type
◦ bytes
◦ bytes_in
◦ bytes_out
◦ duration
◦ file_name
◦ http_content_type
◦ lease_duration
◦ message_id
◦ method
◦ packets
◦ packets_in
◦ packets_out
◦ record_type
◦ referrer
◦ request_body_len
◦ response_body_len
◦ sender
◦ service
◦ status
◦ transport
◦ url
◦ user_agent
◦ user
• Removed incorrect mappings for “body”, “subject”, “orig_recipient”, and “severity”
• Added mappings for “ssl_issuer_email” and “ssl_issuer_organization”
• Added a value for vendor_action field