Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
This snippet configures bro to write logs out in JSON instead of the tab-delimited format. It also configures it to use ISO8601 timestamps instead of unix epoch time.
## Configure bro to write JSON logs
mkdir -p /opt/bro/share/bro/site/scripts
sudo tee /opt/bro/share/bro/site/scripts/json-logs.bro << EOF
@load tuning/json-logs
redef LogAscii::json_timestamps = JSON::TS_ISO8601;
redef LogAscii::use_json = T;
EOF
sudo tee -a /opt/bro/share/bro/site/local.bro << EOF
# Load policy for JSON output
@load scripts/json-logs
EOF
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment