Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

set zeek.uid to conn_uids for files.log entries #33

Closed
mmguero opened this issue Jan 22, 2021 · 1 comment
Closed

set zeek.uid to conn_uids for files.log entries #33

mmguero opened this issue Jan 22, 2021 · 1 comment
Assignees
@mmguero
Labels
logstash Relating to Malcolm's use of Logstash zeek Relating to Malcolm's use of Zeek
Projects
Malcolm

Comments

@mmguero
Copy link
Collaborator

mmguero commented Jan 22, 2021

It appears that for (at least some) files.log entries, the FUID is getting set for both zeek.uid and zeek.fuid. It would be more useful to put the connection ID(s) in zeek.uid.
@mmguero mmguero added logstash Relating to Malcolm's use of Logstash zeek Relating to Malcolm's use of Zeek labels Jan 22, 2021
@mmguero mmguero self-assigned this Jan 22, 2021
mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Jan 25, 2021
@mmguero
Fix idaholab#33 by setting zeek.uid to conn_uids[0] when available, f…
5064e59 
…or files.log
@mmguero
Copy link
Collaborator Author

mmguero commented Jan 25, 2021

Fixed in 2.6.1.

@mmguero mmguero closed this as completed Jan 25, 2021
@mmguero mmguero mentioned this issue Feb 5, 2021
Merged
mmguero added a commit to cisagov/Malcolm that referenced this issue Feb 5, 2021
@mmguero
Topic/2.6.1 merge (#159)
8d5e416 
Malcolm v2.6.1 contains the following changes:

v2.6.0...v2.6.1

* Added [TFTP](https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol) [Zeek parser](https://github.com/zeek/spicy-tftp) and corresponding Logstash parsing, Arkime WISE support and Kibana dashboards
* Provide browser-based access to zeek/extracted-files directory (idaholab#34)
* Fix LDAP analyzer not parsing all events (idaholab#35)
* Provide more fine-tuned controls for Zeek's node.cfg in Hedgehog sensor (idaholab#36, /pull/158)
* set zeek.uid to conn_uids for files.log entries (idaholab#33)
* Modify Zeek build chain to use default GCC compilers instead of LLVM/clang,which reduces build dependencies
* Use Firefox instead of Chromium for browser in ISO-installed versions of Malcolm and in Hedgehog Linux
* Updated copyright notices in text from "2020" to "2021" (which is the bulk of the changed files in this commit)
* Version bumps
  * Yara to 4.0.4
@mmguero mmguero added this to Done in Malcolm Feb 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mmguero mmguero

Labels
logstash Relating to Malcolm's use of Logstash zeek Relating to Malcolm's use of Zeek
Projects
No open projects
Malcolm
  
Done
Milestone
No milestone
Development

No branches or pull requests
1 participant
@mmguero