Sending Zeek events with filebeat to SecurityOnion 2.4

[clopmz]

Hi all,

Is it possible to send Zeek events via Filebeat from a host that is not part of the SecurityOnion grid? My Zeek hosts are FreeBSD based and Elastic Agent is not supported under FreeBSD only beats (filebeat, metricbeat, etc).

Another option I can configure is to use Kafka, but can SecurityOnion act as a consumer for kafka to request Zeek events?

Many thanks.

[reyesj2]

May take some work but logstash has a Kafka input policy you can leverage to consume from Kafka topics https://www.elastic.co/guide/en/logstash/current/plugins-inputs-kafka.html
OR
again may take some work on ingest pipeline for how documents get parsed but logstash has beats input https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html

I should also mention Security Onion Pro includes Kafka as a feature and may be an option. https://docs.securityonion.net/en/2.4/pro.html

[clopmz]

And, is it not possible to send zeek events via filebeat to SecurityOnion's logstash?