Dovehawk.io Anonimized Outgoing Flow Collector Module for Zeek
This module colects outgoing flow counts to external IPs across an entire Cluster or Standalone Zeek instance. The local source IPs are not tracked and SUMSTATS is used to sum multiple requests over a specified time period anonymizing and grouping the requests across the entire network.
Local hostnames are stripped to further anonymize the data for external sharing.
DoveHawk Flow Reported
DoveHawk flow.log Local Log
Zeek > 2.6.1 (Some 2.5 versions may work but testing showed issues with triggering the SUMSTATS finished epoch).
Curl command line version used by ActiveHTTP
See dovehawk_lambda for an AWS Lambda serverless function to store reporting in RDS Aurora.
Tyler McLellan @tylabs