Skip to content

Instantly share code, notes, and snippets.

View FrankHassanabad's full-sized avatar
🎧
Eat Sleep Code Repeat

Frank Hassanabad FrankHassanabad

🎧
Eat Sleep Code Repeat
  • https://radicl.com/
  • Boulder, Co
View GitHub Profile
@dcode
dcode / configure_bro_json-logs.sh
Last active April 10, 2020 20:28
This snippet configures bro to write logs out in JSON instead of the tab-delimited format. It also configures it to use ISO8601 timestamps instead of unix epoch time.
## Configure bro to write JSON logs
mkdir -p /opt/bro/share/bro/site/scripts
sudo tee /opt/bro/share/bro/site/scripts/json-logs.bro << EOF
@load tuning/json-logs
redef LogAscii::json_timestamps = JSON::TS_ISO8601;
redef LogAscii::use_json = T;
EOF
sudo tee -a /opt/bro/share/bro/site/local.bro << EOF