CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

soc for zeek

Browse Source
This commit is contained in:
m0duspwnens
2022-09-20 16:22:54 -04:00
parent 1685e0e6db
commit e1ea3c2031
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
salt/zeek/soc_zeek.yaml
View File

@@ -3,16 +3,23 @@ zeek:
enabled:
description: This is a list of zeek logs that will be shipped through the pipeline. If you remove a log from this list it will still persist on the sensor.
config:
local:
'@load':
description: List of Zeek policies to load
'@load-sigs':
description: List of Zeek signatures to load
node:
lb_procs:
description: This is the amount of CPUs to use for Zeek. This setting is ignored if you are using pins.
node: True
zeek_pins_enabled:
description:
pins_enabled:
description: Enabled CPU pinning
node: True
zeek_pins:
description: List of CPUs you want to
advanced: True
pins:
description: List of CPUs you want to pin to
node: True
advanced: True
zeekctl:
CompressLogs:
description: Enable compression of zeek logs. If you are seeing packet loss at the top of the hour in zeek or pcap you might need to set this to 0. This will use more disk space but save IO and CPU.
@@ -26,8 +33,4 @@ zeek:
advanced: True
file_extraction:
description: This is a list of mime types Zeek will extract from the network streams.
load:
description: List of Zeek policies to load
load-sigs:
description: List of Zeek signatures to load