threatbus-zeek 2022.5.16

A plugin to enable threatbus communication with Zeek network monitor.

Threat Bus Zeek Plugin

A Threat Bus plugin that enables communication to Zeek.

Installation

pip install threatbus-zeek

Prerequisites

Install Broker on the Threat Bus host

The plugin uses the Broker python bindings to enable communication with Zeek. You have to install Broker and bindings to use this plugin.

Configuration

The plugin starts a listening Broker endpoint. The endpoint characteristics for listening can be cofigure as follows:

...
plugins:
  apps:
    zeek:
      host: "127.0.0.1"
      port: 47761
      module_namespace: Tenzir
...

Threat Bus Zeek Script

Threat Bus is a pub/sub broker for threat intelligence data. Applications, like Zeek, have to register themselves at the bus. Hence, load this Zeek script into your Zeek installation to make it aware of Threat Bus.

The script can be configured via certain options for setting topic names or requesting an intel snapshot:

zeek -i <INTERFACE> -C ./apps/zeek/threatbus.zeek -- "Tenzir::snapshot_intel=-30 days"

License

Threat Bus comes with a 3-clause BSD license.