outputting only a single log

Zeek
1

Hi there,

Do you have a brief set of instructions for how to have a command like bro --iface output only one of the default logs? E.g. the conn.log.

image001.png

2

Do you have a brief set of instructions for how to have a command like
bro --iface <interface> output only one of the default logs? E.g. the
conn.log.

Per the similar stackoverflow post [1], you can do this with:

    bro -i <interface> -b base/protocols/conn

The flag -b runs Bro in "bare mode." This disables all default scripts.
You can then manually turn on only the scripts you need.

    Matthias

[1] security - Bro: Log only one stream - Stack Overflow