I am actively building out an Azure environment and would love to include Zeek in the environment for IDS and monitoring.
Are there any deployment models for how (if possible) this can be achieved? Azure network TAP/SPAN features are wholly subpar for real-life use, but I was hoping some may have solved this without too many complexities.
I deployed it in the past as a basic appliance being in the middle of traffic flows, but this is not ideal for production use.
Any insight/links would be appreciated, my searches so far have not surfaced much.
Thank you.
Ken