dcode
/ configure_bro_json-logs.sh
Last active
April 10, 2020 20:28
This snippet configures bro to write logs out in JSON instead of the tab-delimited format. It also configures it to use ISO8601 timestamps instead of unix epoch time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## Configure bro to write JSON logs | |
| mkdir -p /opt/bro/share/bro/site/scripts | |
| sudo tee /opt/bro/share/bro/site/scripts/json-logs.bro << EOF | |
| @load tuning/json-logs | |
| redef LogAscii::json_timestamps = JSON::TS_ISO8601; | |
| redef LogAscii::use_json = T; | |
| EOF | |
| sudo tee -a /opt/bro/share/bro/site/local.bro << EOF |
OlderNewer