Decode HTTP2 on zeek

[masedira]

Version

2.4.110

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

20

Storage for /

100

Storage for /nsm

300

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Reviving this old thread which was unanswered 2y ago and is now locked

==========================

Hi all,

I am trying to analyze HTTP2 traffic, but it seems the zeek http2 decoder is not installed.
There is a package called bro-http2 https://github.com/MITRECND/bro-http2 which can perform that task,

it works on my standalone zeek server, but I don't know how to add it to zeek within the security onion environment.

Is there a way to install additional zeek packages on top of the default ones that come with security onion?

Thanks

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[TOoSmOotH]

There is no current way to add your own plugins. We will look at possibly adding this plugin when we migrate to Zeek 7. There is more to it then just enabling the plugin though. We have to make sure the new log file is picked up and is being parsed properly. Then add it to all the dashboards etc.

[masedira]

Thanks @TOoSmOotH ,

To further explain the issue, I have an inline SSL decryption solution which sends a copy of the decrypted traffic to SO.

I first noticed that files are not being extracted and after some troubleshooting I realized that most of the sessions are HTTP2.

So not having the http2 decoder in so-zeek will make this a big blindspot.

I have a standalone zeek server as well and upon installing the pluging things started working for that decrypted traffic.

My suggestion would be to include the plugin in a basic way initially to solve this issue , i.e. just leave the default zeek log files / not adding it to the dashboard ..etc... which can come at a later stage.

[reyesj2]

@masedira With .120 you should see http2 support in Zeek with the mitrecnd/bro-http2 plugin

[masedira]

Thanks @reyesj2 this is amazing news.