Skip to content

Instantly share code, notes, and snippets.

@cyhook
Forked from dcode/configure_bro_json-logs.sh
Created August 3, 2019 10:42
Show Gist options
  • Save cyhook/80b5df61842f6d184f05687668afe56f to your computer and use it in GitHub Desktop.
Save cyhook/80b5df61842f6d184f05687668afe56f to your computer and use it in GitHub Desktop.
This snippet configures bro to write logs out in JSON instead of the tab-delimited format. It also configures it to use ISO8601 timestamps instead of unix epoch time.
## Configure bro to write JSON logs
mkdir -p /opt/bro/share/bro/site/scripts
sudo tee /opt/bro/share/bro/site/scripts/json-logs.bro << EOF
@load tuning/json-logs
redef LogAscii::json_timestamps = JSON::TS_ISO8601;
redef LogAscii::use_json = T;
EOF
sudo tee -a /opt/bro/share/bro/site/local.bro << EOF
# Load policy for JSON output
@load scripts/json-logs
EOF
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment