# Web GUI for Bro? **URL:** \ **Category:** Zeek\ **Created:** [January 21, 2017, 11:54am UTC](https://community.zeek.org/t/web-gui-for-bro/4611 "2017-01-21T11:54:04Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![project722](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@project722](https://community.zeek.org/u/project722)\ **Post date:** [January 21, 2017, 11:54am UTC](https://community.zeek.org/t/web-gui-for-bro/4611/1 "2017-01-21T11:54:04Z")
Got Bro 2.4.1 working on a RHEL 6 system. Can anyone provide suggestions on what I should use as a web GUI for bro? What is the best options out there? NOTE - my version of Bro was compiled from source. ---
**Author:** ![Patrick\_Kelley1](https://avatars.discourse-cdn.com/v4/letter/p/aeb1de/32.png) [@Patrick\_Kelley1](https://community.zeek.org/u/Patrick_Kelley1)\ **Post date:** [January 21, 2017, 1:22pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/2 "2017-01-21T13:22:23Z")
You might consider using an ELK stack for it for an open-source solution. If your traffic is light, there is a free version of Splunk out there. Adjust your filebeat yaml file to pickup the Bro logs. /usr/local/bro/logs/current/\*.log [https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04) Packetsled makes a solid commercial solution built on Bro. **Patrick Kelley, CISSP** **Hyperion Avenue Labs** (770) 881-6538 _The limit to which you have accepted being comfortable is the limit to which you have grown. Accept new challenges as an opportunity to enrich yourself and not as a point of potential failure._ ---
**Author:** ![project722](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@project722](https://community.zeek.org/u/project722)\ **Post date:** [January 25, 2017, 1:48pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/3 "2017-01-25T13:48:32Z")
Thanks All. I am looking into ELK. ---
**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\ **Post date:** [January 25, 2017, 9:27pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/4 "2017-01-25T21:27:00Z")
Hi, Check my docker project. [https://hub.docker.com/r/danielguerra/bro-debian-elasticsearch/](https://hub.docker.com/r/danielguerra/bro-debian-elasticsearch/) The quick way : export DOCKERHOST=":8080" wget [https://raw.githubusercontent.com/danielguerra69/bro-debian-elasticsearch/master/docker-compose.yml](https://raw.githubusercontent.com/danielguerra69/bro-debian-elasticsearch/master/docker-compose.yml) docker-compose pull docker-compose up You can send pcap data with pcap to port 1969 “nc dockerip 1969 \< mypcapfile” After this open your browser to dockerip:5601 for kibana, its preconfigured with some queries and desktops. ---
**Author:** ![project722](https://avatars.discourse-cdn.com/v4/letter/p/eada6e/32.png) [@project722](https://community.zeek.org/u/project722)\ **Post date:** [January 25, 2017, 9:55pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/5 "2017-01-25T21:55:40Z")
This ELK/Bro combo is turning out to be more of a learning curve than I has hoped for. I can get the logs over to elasticsearch and into Kibana, but I can only see them on the “Discovery” tab. I save the search to use with a visualization, but it wants to do something by “count” and its not breaking down the connections in conn.log and graphing them like I had hoped for. Here is my logstash conf file. input { stdin { } file { path =\> “/opt/bro/logs/current/\*.log” start\_position =\> “beginning” } } filter { if [message] =~ /^(\d+.\d{6}\s+\S+\s+(?:[\d.]+|[\w:]+|-)\s+(?:\d+|-)\s+(?:[\d.]+|[\w:]+|-)\s+(?:\d+|-)\s+\S+\s+\S+\s+\S+\s+\S+\s+[^:]+::\S+\s+[^:]+::\S+\s+\S+(?:\s\S+)\*$)/ { grok{ patterns\_dir =\> “/opt/logstash/custom\_patterns” match =\> { message =\> “%{291009}” } add\_field =\> [“rule\_id”, “291009”] add\_field =\> [“Device Type”, “IPSIDSDevice”] add\_field =\> [“Object”, “Process”] add\_field =\> [“Action”, “General”] add\_field =\> [“Status”, “Informational”] } } #translate { # field =\> “evt\_dstip” # destination =\> “malicious\_IP” # dictionary\_path =\> ‘/opt/logstash/maliciousIPV4.yaml’ #} #translate { # field =\> “evt\_srcip” # destination =\> “malicious\_IP” # dictionary\_path =\> ‘/opt/logstash/maliciousIPV4.yaml’ #} #translate { # field =\> “md5” # destination =\> “maliciousMD5” # dictionary\_path =\> ‘/opt/logstash/maliciousMD5.yaml’ #} #date { # match =\> [“start\_time”, “UNIX”] #} } output { elasticsearch { hosts =\> [“localhost:9200”] } stdout { codec =\> rubydebug } In Kibana under the Discover tab I can see my messages from conn.log. How can I get this data properly graphed and broken down more like how the connection summary emails are broken down? ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [January 25, 2017, 10:02pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/6 "2017-01-25T22:02:50Z")
Mod this to your liking and see how it goes: ---
**Author:** ![Craig\_Pluchinsky](https://avatars.discourse-cdn.com/v4/letter/c/ba9def/32.png) [@Craig\_Pluchinsky](https://community.zeek.org/u/Craig_Pluchinsky)\ **Post date:** [January 26, 2017, 12:40pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/7 "2017-01-26T12:40:15Z")
I started to use the csv filter instead of grok. Just change the delimiter to a literal tab. Also make sure to not use "." in the column names. I just copied the bro field names.    if [type] == "bro\_conn" {      csv {        columns =\> ["ts","uid","orig\_h","orig\_p","resp\_h","resp\_p","proto","service","duration","orig\_bytes","resp\_bytes","conn\_state","local\_orig","local\_resp","missed\_bytes","history","orig\_pkts","orig\_ip\_bytes","resp\_pkts","resp\_ip\_bytes","tunnel\_parents","peer\_descr","orig\_cc","resp\_cc"]        separator =\> " "      }    } ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [January 26, 2017, 1:37pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/8 "2017-01-26T13:37:33Z")
Oh yea that’s a lot easier…thanks for that Craig! James ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/web-gui-for-bro/4611/9 "2022-05-06T15:44:31Z")