Skip to content

Custom configurations of Zeek docker instance #54

@blacklabssecurity

Description

@blacklabssecurity

I seem to be struggling with where I need to make changes to zeek (persistent over reboots). I have changed the top_dir to a new location but I prefer to have the following changes to how zeek operates:

  1. Set LogDir to /storage/pcap
  2. Set LogExpireInterval to a 20 day window
  3. Set LogRotationInterval to a 10 day window
  4. MinDiskSpace to 90
  5. Have zeek cron clean up at this point
  6. Define known/trusted networks
  7. Rename interfaces in zeek (or create reference as) INGRESS and EGRESS

I understand not to change the zeek/etc/zeekctl.cfg, node.cfg and netwroks.cfg files in this docker deployment. I did follow the instructions to change top_dir but do not understand how to change other options for the zeekctl-config.sh to run with.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions