Getting Data In

Bro 2.6.4 forward to splunk

tazzvon
Engager

I am not the best with setup so i am looking for an all in one step by step for getting bro logs into splunk. I previously had the logs forwarded but the fields were not showing up. Here is my setup thus far:
Bro 2.6.4 on Ubuntu server 18.04 LTS (fresh Install based on https://wpcademy.com/how-to-install-bro-network-security-monitor-on-ubuntu-16-04-lts/ minus the geoIP stuff)
Splunk Enterprise 8.0.1 (fresh install based on https://docs.splunk.com/Documentation/Splunk/8.0.1/Installation/InstallonLinux)
started and created admin
configured to start on boot
I just see so many bits and pieces of what to do next to get Bro logs into Splunk i find myself doing the trial and error thing.
Thank you for any help (i know this can't be that difficult)

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@tazzvon

Have you tried Splunk Add-on for Zeek aka Bro?

The Splunk Add-on for Zeek aka Bro supports two log formats: TSV and JSON. JSON format is support for Zeek aka Bro versions 2.3.x, 2.4.x, and 2.5.x. Not sure about 2.6.x but you can try if there are no change logs.

Splunkbase link: https://splunkbase.splunk.com/app/1617/ ?
Documentation: https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Description

You can find bro configuration in below link.
https://docs.splunk.com/Documentation/AddOns/released/BroIDS/Configuration#Configure_Bro_log_monitor...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...