Proper method to enable ARP to be collected in local.zeek ?

[innovate-support]

I'm using SO 2.4.110. I'd like to collect MAC info along with IP and Ports from Zeek. Skynet is suggesting that I simply add @load base/protocols/arp to my local.zeek file and restart, supposedly resulting in a arp.log file that's searchable. Is that accurate? I don't want to start messing with zeek files and break my system. If it's that easy, why isn't it collecting arp data by default?

[cm-ops]

There is no script for arp in base/protocols. I do see a plugin https://docs.zeek.org/en/v6.0.9/scripts/base/bif/plugins/Zeek_ARP.events.bif.zeek.html but plugins are not supported. You might be able to find a script for Zeek to generate the arp.log, but you would need to add a zeek.arp ingest pipeline to see them in an index.

[innovate-support]

I'd like to request the addition of Mac Address as something that Security Onion collects by default, through whichever ingesting method it's possible to do so.

[dougburks]

By default, our Zeek configuration should be writing ARP and MAC data to /nsm/zeek/logs/current/ecat_arp_info.log. However, this log is not ingested into Elasticsearch by default.

To ingest the data into Elasticsearch, go to your Zeek excluded configuration as shown at https://docs.securityonion.net/en/2.4/zeek.html#configuration, remove ecat_arp_info from the list, and save the configuration. Wait 15 minutes for the configuration to take effect or force it immediately.

Once this data is flowing into Elasticsearch, you should be able to go to Dashboards and paste the following for a simple MAC address dashboard:

tags:ecat_arp_info | groupby source.mac | groupby -sankey source.mac ecat.arp.type | groupby ecat.arp.type | groupby -sankey ecat.arp.type destination.mac | groupby destination.mac

If you want to see the MAC/IP relationships as well:

tags:ecat_arp_info | groupby source.ip | groupby -sankey source.ip source.mac | groupby source.mac | groupby -sankey source.mac ecat.arp.type | groupby ecat.arp.type | groupby -sankey ecat.arp.type destination.mac | groupby destination.mac | groupby -sankey destination.mac destination.ip | groupby destination.ip

[innovate-support]

Brilliant! Thanks Doug!!