-
-
Save cyhook/80b5df61842f6d184f05687668afe56f to your computer and use it in GitHub Desktop.
This snippet configures bro to write logs out in JSON instead of the tab-delimited format. It also configures it to use ISO8601 timestamps instead of unix epoch time.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## Configure bro to write JSON logs | |
mkdir -p /opt/bro/share/bro/site/scripts | |
sudo tee /opt/bro/share/bro/site/scripts/json-logs.bro << EOF | |
@load tuning/json-logs | |
redef LogAscii::json_timestamps = JSON::TS_ISO8601; | |
redef LogAscii::use_json = T; | |
EOF | |
sudo tee -a /opt/bro/share/bro/site/local.bro << EOF | |
# Load policy for JSON output | |
@load scripts/json-logs | |
EOF |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment