quick-zeek-container

If you want to run a pcap through Zeek, but don't have ROCK or don't need "all the things".

# Fire up the Docker container, mapping the directory with your pcap
## If pcap in your current directory
docker run -it -v $(pwd):/pcap broplatform/bro:3.0.0 /bin/bash
## If pcap is somewhere else
docker run -it -v [directory where your pcap is]:/pcap broplatform/bro:3.0.0 /bin/bash

# If you have to build your own for some reason
# This can be skipped if the `docker run...` worked above
git clone https://github.com/zeek/zeek-docker.git
cd zeek-docker
make build-stamp_3.0.0

# Now that you're in the container, browse to the directory with the PCAP
cd /pcap

# Replay the pcap 
## w/ASCII ouput
zeek -C -r [your pcap file].pcap

## JSON output
zeek -C -r [your pcap file].pcap policy/tuning/json-logs.zeek