Mandiant & Security Onion
Channel: Zeek
Date: 2014-04-15

In this talk, we'll review the current Bro integration in Security Onion and then talk about our future plans to do even more cool stuff with Bro! The first being a Bro script written by Scott to act as a replacement for a "tcpflow -cr" session transcript with the added bonus of handling gzip-encoded content and also UDP traffic. The second idea is to leverage our existing Bro conn logs in a distributed ELSA database and extend the solution to replace the functionality currently provided by prads session data going into a single central database. We'll show how these two ideas, made possible by Bro, will allow security analysts to more quickly respond and have greater confidence in their analysis.