You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The code that handles the logging in file-monitor, logging the results of the file scanners like capa, clamav, yara, etc., is just of hacky, in that it writes to sort of a fake Zeek signatures.log file that gets handled with the rest of the zeek logs.
I want to change that logging code to skip that intermediate step and simply send straight to logstash (or, if that's not possible, our filebeat TCP listener) instead. This will be something that will make it easier to handle more varied output from Strelka (see #485),
The text was updated successfully, but these errors were encountered:
mmguero
added
carving
Relating to carving (extraction) of files from traffic and the scanning of those files
logstash
Relating to Malcolm's use of Logstash
labels
Jan 16, 2025
The code that handles the logging in file-monitor, logging the results of the file scanners like capa, clamav, yara, etc., is just of hacky, in that it writes to sort of a fake Zeek signatures.log file that gets handled with the rest of the zeek logs.
I want to change that logging code to skip that intermediate step and simply send straight to logstash (or, if that's not possible, our filebeat TCP listener) instead. This will be something that will make it easier to handle more varied output from Strelka (see #485),
The text was updated successfully, but these errors were encountered: