Bro-ELK
安装配置
具体的安装过程就不在描述了，官网上面的文档很详细，这里主要就是讲讲如何把bro解析的日志导出到ELK里面，之前在github搜别人贴的配置文件发现还是有一些坑。
禁用协议
在安装bro后实际我们用不着那么多协议解析，尤其是在大流量环境下很费性能 在/usr/local/bro/share/bro/site/目录下创建disable_analyzer.bro
event bro_init()
{
Log::disable_stream(X509::LOG);
Log::disable_stream(Weird::LOG);
Log::disable_stream(Files::LOG);
}
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_AYIYA };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_DCE_RPC };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_DHCP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_DNP3_TCP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_IRC };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_IRC_DATA };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_MODBUS };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_XMPP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_SYSLOG };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_SIP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_RFB };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_RADIUS };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_NCP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_SNMP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_TEREDO };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_FTP_DATA };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_FTP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_BACKDOOR };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_DNP3_UDP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_FINGER };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_GNUTELLA };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_GSSAPI };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_GTPV1 };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_IDENT };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_NVT };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_PIA_TCP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_PIA_UDP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_SIP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_NCP };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_NFS };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_BITTORRENTTRACKER };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_FTP_ADAT };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_POP3 };
redef Analyzer::disabled_analyzers += { Analyzer::ANALYZER_STEPPINGSTONE };
然后在local.bro添加
@load disable_analyzer.bro
安装配置
在安装bro与elk后，首先我们要将bro的日志改成json格式，默认是以TAB分隔
在/usr/local/bro/share/bro/policy/tuning下面新建json-logs.bro
redef LogAscii::use_json=T;
然后在/usr/local/bro/share/bro/site/local.bro里面添加
@load policy/tuning/json-logs.bro
将logstash.conf配置文件放到/etc/logstash/conf.d/bro.conf，然后运行logstash -f 加载配置文件
参考来源
https://doc.yonyoucloud.com/doc/logstash-best-practice-cn/index.html
https://github.com/timmolter/logstash-dfir/tree/master/conf_files/bro
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent