Ok not sure if in the right section.   So I have been using Zeek for Splunk and TA_suricata and we are getting a lot of IPs of course.   And I built out some IPs and CIDR in csv.  What is the best way to add into the app or should it be a seperate lookup that could be used anywhere?    Not sure if there is differance between IP lookup vs CIDR lookup.    Was also thinking of merging the apps in to one app, but that might be another question for a later day.   Thanks ... View more

So I am working off a query based off the Splunk app for *nix.  It uses the interfaces.sh.     query: index=os sourcetype=interfaces host=server Name=eth* | head 8 | eval status = if (RXbytes = "0", "UP", 'DOWN") | stats values(RXbytes) by Name   Basically I want to show the 8 interfaces, have the # of RX Bytes in each Single Value and color coded for UP/DOWN - which I set via the dashboard option  0-1 - Red 1-500 - Yellow 500 - Max - Green Also starting to wonder if I really need the eval statement in there?  I I would like it to look like ETH1   ETH 2  ETH 3  ETH 4   ETH 5  ETH 6  ETH 7  ETH 8 vice ETH1 ETH2 ETH 3 ETH 4 ETH 5 ETH 6 ETH 7 ETH 8   is that possible, sorry system is not connected so its kind of a pain to get screen shots.   ... View more

Looking for a way to monitor sniffing ports on a sensor.  Each port is tied to a different part of the system and would like a dashboard notification UP/DOWN if traffic has not been rcvd say in 1-5 minutes.   i thought about doing IFCONFIG, but I think I made it to complicated by using grep to narrow down just the RX/TX information.    ifconfig | egrep -e ^eth | grep -v "inet\|UP"  which does a pretty good job for CLI output.    I tried installing the App *Nix but cant really get it to work.   I am using a Splunk server, and the "sensors" are a dffierant server which has the UFW.     Thanks   ... View more

So I am getting data ingested from Bro/Zeek and Suricata via the TA's for said applications. I want to build data models for them and wanted to see if anyone has anything built for Bro/Zeek or Suricata. So far I built a "data model" for suricata (called suricata) Then a Root Event (index=suricata source=suricata sourcetype=suricata) From there I have Child Src_ip (src_ip=192.168.*) Then children of that are broken out like this --Severity ------Severity I (suricata.attack.severity=1) ------Severity II (suricata.attack.severity=2) ------Severity III(suricata.attack.severity=3) --Category Dest_ip Well you get the point. Is there a better way of doing this, or am I on sort of the right track? ... View more

So I am running SecurityOnion 16.04 and using Suricata/Zeek. Suricata - ET Rules/Snort Rules Zeek - AlienVault OTX. I have read that other folks are ingesting the rule sets as a seperate index inside of Splunk (say one for OTX, and one for ET). One how would I go about this, would I pull a new request from the say AlienVault OTX and build the index this way or try and just monitor the file created for the rules (for Zeek, its called bro_otx.dat (which looks to be a TSV file). I tried to ingest the DAT file but it comes up as Binary. Have not gotten around to try and ingest the Suricata Rules yet, they are in a file called download.rules 2nd question is there a good reason to ingest the rules seperate from what Zeek/Suricata reports on? Thanks ... View more

Looking for assistance to search Bro/Zeek for peaks/dips in traffic (what is the best sourcetype to go by). Also if anyone is good with Bro/Zeek how can I see what occured when for about a week bro_conn (connections) did not ingest but the other sourcetypes for bro were still being ingested. ... View more