Add a new zeek script to my security onion

[geoleb]

Version

2.4.170

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,
I am trying to create a new network analyzer using zeek under securityonion standalone. I need to include it. I tried to install it in /opt/so/saltstack/local/salt/zeek/policy/.

If I run an so-pcpap-import I have this in /nsm/import/xxxxx/zeek/logs/console.log:
/fatal error in /opt/zeek/share/zeek/site/local.zeek, line 51: can't find ./policy/myscripts.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

You would add your custom script(s) to /opt/so/saltstack/local/salt/zeek/policy/custom/. Then modify Zeek local in SOC > Administration > Configuration > zeek > config > local > load and add your script custom/my_script.