There is no tutorial on custom script zeek in securityonion 2.4

[phamkhanhhung1998]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Eval

Location

other (please provide detail below)

Hardware Specs

Does not meet minimum requirements

CPU

2

RAM

8

Storage for /

120 gb

Storage for /nsm

60

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

There is no tutorial on custom script zeek in securityonion 2.4 and I can't figure out how to add a new script to zeek so it can run because version 2.4 has many differences from 2.3. I hope everyone can help me and give me instructions

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

You would still place the scripts in /opt/so/saltstack/local/salt/zeek/policy/custom/. Then in the GUI, Administration > Configuration > zeek > config > local > load add custom/my-script