# Zeek (Bro) module

## Install and Configure Zeek/Bro

### Install Zeek/Bro (for MacOS with Brew)

```
brew install bro
```

* Configure it to process network traffic and generate logs. 
* Edit `/usr/local/etc/node.cfg` to use the proper network interfaces. 
* Edit `/usr/local/etc/networks.cfg` to specify local networks accordingly.
* Set `redef LogAscii::use_json=T;` in `/usr/local/share/bro/site/local.bro` to use JSON output. 

### Install Zeek/Bro (for Ubuntu Linux)

```
apt install bro
apt install broctl
```

* Configure it to process network traffic and generate logs. 
* Edit `/etc/bro/node.cfg` to use the proper network interfaces. 
* Edit `/etc/bro/networks.cfg` to specify local networks accordingly.
* Set `redef LogAscii::use_json=T;` in `/usr/share/bro/site/local.bro` to use JSON output. 

## Start Zeek/Bro

```
sudo broctl deploy
```

## Download and install Filebeat

Grab the filebeat binary from elastic.co, and install it by following the instructions.

## Configure Filebeat module and run

Update filebeat.yml to point to Elasticsearch and Kibana. Setup Filebeat.

```
./filebeat setup --modules zeek -e -E 'setup.dashboards.enabled=true'
```

Enable the Filebeat zeek module

```
./filebeat modules enable zeek
```

Start Filebeat

```
./filebeat -e
```

Now, you should see the Zeek logs and dashboards in Kibana.