Airgapped - Missing Zeek container on Forward Node

[wildlyunder]

Hi,

We're missing Zeek on all our Forward nodes and the only solution I've found is to run the following on the master:
sudo so-docker-refresh

When I tried to run this on an Airgapped installed of security onion it tired to connect to the internet.

Any ideas on who I can get Zeek installed on the forward node in an airgapped environment?

[dougburks]

When you ran Setup, did you choose to use Zeek for metadata instead of Suricata?

Is this a new installation or an existing installation that you updated?

If existing, did you ever have Zeek on the forward nodes?

[dougburks]

If you chose Suricata instead of Zeek for metadata, then there is no reason for Zeek to run.

[wildlyunder]

If we wanted to use Zeek and Suricata how would we enable both?

[dougburks]

You can use Suricata for Alerts and Zeek for metadata. We do not support running both Suricata metadata and Zeek metadata on the same box as this would create duplicate metadata.

[wildlyunder]

How do I change to use Suricata for alerts and zeek for metadata? Would this impact our use of ET Pro?

[dougburks]

How do I change to use Suricata for alerts and zeek for metadata?

The process for switching from Zeek metadata to Suricata metadata is at https://docs.securityonion.net/en/2.3/suricata.html#metadata and you should be able to perform similar steps but set mdengine to ZEEK.

Would this impact our use of ET Pro?

ET PRO is a NIDS ruleset and really only applies to Suricata alerting not metadata.