Skip to content
zeek-ssh-interesting-hostnames-with-known
Zeek
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
scripts
tests
.gitignore
COPYING
README.md
bro-pkg.meta

README.md

zeek-ssh-interesting-hostnames-with-known

This package requires zeek-known-hosts-with-dns. You will also need comment out ssh/interesting-hostnames from the default local.bro/local.zeek file.

Description:

The default ssh/interesting-hostnames policy does dns lookups for the source host of every successful ssh authentication. In our environment, the majority of ssh connections are internal and, due to automation, there are a lot of them. This results in Zeek making thousands of asynchronous when() calls for lookup_addr().

By replacing known-hosts with known-hosts-with-dns, we keep a running table of local DNS lookups. Combined with this policy, it can reduce the DNS queries from our Zeek systems by over 90%.

You can’t perform that action at this time.