bro/HTTP2 decoder for zeek

[masedira]

Hi all,

I am trying to analyze HTTP2 traffic, but it seems the zeek http2 decoder is not installed.
There is a package called bro-http2 https://github.com/MITRECND/bro-http2 which can perform that task,

it works on my standalone zeek server, but I don't know how to add it to zeek within the security onion environment.

Is there a way to install additional zeek packages on top of the default ones that come with security onion?

Thanks

[argwfm]

@masedira, did you make any progress on this? Similar challenge here.
Does anyone know if switching to Suricata for meta parses HTTP2?

[masedira]

Hi @argwfm, I didn't find any information after extensive searching and no one answered the question here.
In my case it was rather nice to have, but not critical, so I stopped wasting time on it

Hopefully, someone experienced will reach this post one day and help us out.