Skip to main content

Zeek

The Zeek Matano managed log source lets you ingest your Zeek logs directly into Matano.

Usage

Use the managed log source by specifying the managed.type property in your log_source as ZEEK.

name: "zeek"

managed:
type: "ZEEK"

Then create tables for each of the Zeek logs you want to ingest. For example, if you want to ingest Zeek DNS and HTTP logs, create table files like so:

my-matano-dir/
└── log_sources/
└── zeek/
└── log_source.yml
└── tables/
└── dns.yml
└── http.yml
└── ...
# log_sources/zeek/tables/dns.yml
name: "dns"

For a complete reference on configuring log sources, including extending the table schema, see Log source configuration.

Tables

The Zeek managed log source supports the following tables:

  • capture_loss
  • connection
  • dce_rpc
  • dhcp
  • dnp3
  • dns
  • dpd
  • files
  • ftp
  • http
  • intel
  • irc
  • kerberos
  • known_certs
  • known_hosts
  • known_services
  • modbus
  • mysql
  • notice
  • ntlm
  • ntp
  • ocsp
  • pe
  • radius
  • rdp
  • rfb
  • signature
  • sip
  • smb_cmd
  • smb_files
  • smb_mapping
  • smtp
  • snmp
  • socks
  • software
  • ssh
  • ssl
  • stats
  • syslog
  • traceroute
  • tunnel
  • weird
  • x509

Ingest

S3 (default)

For a log source named zeek, a file under the path zeek/afe3c55a-8b05-4ac7-be76-b6fda08af95d/conn.log.gz will be routed to the connection table.

S3 Path scheme to table:

  • *capture_loss* -> capture_loss
  • *conn* -> connection
  • *dce_rpc* -> dce_rpc
  • *dhcp* -> dhcp
  • *dnp3* -> dnp3
  • *dns* -> dns
  • *dpd* -> dpd
  • *files* -> files
  • *ftp* -> ftp
  • *http* -> http
  • *intel* -> intel
  • *irc* -> irc
  • *kerberos* -> kerberos
  • *known_certs* -> known_certs
  • *known_hosts* -> known_hosts
  • *known_services* -> known_services
  • *modbus* -> modbus
  • *mysql* -> mysql
  • *notice* -> notice
  • *ntlm* -> ntlm
  • *ntp* -> ntp
  • *ocsp* -> ocsp
  • *pe* -> pe
  • *radius* -> radius
  • *rdp* -> rdp
  • *rfb* -> rfb
  • *signature* -> signature
  • *sip* -> sip
  • *smb_cmd* -> smb_cmd
  • *smb_files* -> smb_files
  • *smb_mapping* -> smb_mapping
  • *smtp* -> smtp
  • *snmp* -> snmp
  • *socks* -> socks
  • *software* -> software
  • *ssh* -> ssh
  • *ssl* -> ssl
  • *stats* -> stats
  • *syslog* -> syslog
  • *traceroute* -> traceroute
  • *tunnel* -> tunnel
  • *weird* -> weird
  • *x509* -> x509

Schema

Zeek data is normalized to ECS fields. You can view the complete mappings to see the full schemas.