ZEKE activation

[Laguna8899]

Hello everyone,
i need to activate ZEKE on security onion on a machine where it has been deactivated.
How can I activate the zeke module? thank you

[cm-ops]

Would you provide a little more information on you grid please? Let me know what the following command returns salt-call pillar.get global:mdengine

[Laguna8899]

" Local: SURICATA" thank you for help

[cm-ops]

On the manager, edit the global pillar file /opt/so/saltstack/local/pillar/global.sls and change the mdengine variable from SURICATA to ZEEK. Then run a highstate on the node running sensor services.

[Laguna8899]

I need to collect the metadata so MDENGINE with SURICATA still keeping ZEEK enabled. how can I do?

[cm-ops]

For network metadata it is Zeek OR Suricata https://docs.securityonion.net/en/latest/suricata.html?highlight=mdengine#metadata You would still be using Suricata for signature based IDS.

[Laguna8899]

Thanks for the reply, I understand.
But if I want to use SURICATA for METADATA, zeek gets disabled. How can I keep zeek ENABLED while using SURICATA for METADATA?
thank a lot for help

[cm-ops]

I'll reiterate my above. For network metadata it is either Zeek OR Suricata, not both. You will still be running Suricata for NIDS (alerts).

[Laguna8899]

what if i want to zeek for nids (alerts) and suricata for metadata? how can I do?

[cm-ops]

You cannot. I would suggest you check out https://docs.securityonion.net/en/latest/zeek.html and https://docs.securityonion.net/en/latest/suricata.html