I just started working with Zeek. I have been tasked with creating a way for full packet data to be pushed to our Zeek cluster for analysis and processing on a central server, but to have the agents/nodes only running a low resource binary for capturing packets.
I’ve put something together to capture the packets on the node end and receive a compressed stream on the other end, but now I’m having trouble with pushing the packet data into Zeek for processing.
I have looked into a number of things, including the now deprecated Brocolli for intercommunication as well as the event-based scripting, however, it doesn’t seem to be a viable method to watch for all the events and then process it on the manager that way.
Another option I can think of is to capture the packet data, dump it into a PCAP and then process the PCAP manually via Zeek CLI. But, I wanted to see if there’s any other way I can do this.