Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

How to push Snort, Bro, YAF log to Metron

How to push Snort, Bro, YAF log to Metron

New Contributor

Hi everyone.

I configured Apache Metron full dev 0.3 but I don't push Snort, Bro, Yaf log to Metron Server. Can you help me?

5 REPLIES 5
Highlighted

Re: How to push Snort, Bro, YAF log to Metron

New Contributor

As of version 0.3.1 we implemented sensor-stubs, which pushes sample bro, snort, and yaf data into metron by default when you spin up full-dev. Can you try that version instead? That would be the easiest way to see data in your full-dev cluster, and you can find the relevant information about the sensor-stubs here.

If you are pinned to 0.3.0 for some reason, you should be able to put bro logs onto the bro topic, snort logs onto the snort topic, or yaf logs onto the yaf topic in order to get them ingested, and then properly validate by running curl against elasticsearch (or just by looking in kibana). To push them onto those topics there are a lot of options, but you may want to look into some of the simple kafka producer scripts included in full-dev under /usr/hdp/current.

Re: How to push Snort, Bro, YAF log to Metron

New Contributor

Hi @Jon Zeolla. Thank you for your answer.

I set up separate servers Snort, YAF, Bro. How to I ingest log from that servers into metron?

Re: How to push Snort, Bro, YAF log to Metron

Rising Star

Install the Metron Bro plugin into your Bro install. This will push the Bro output into Kafka so that Metron can consume it.

You can use the Ansible deployment steps as instructions for one, simple way to pipe YAF and Snort output into Kafka. This is only suitable for small scale testing.

You're going to want to use something `yafzcbalance` for scaling YAF to higher throughput.

You can use Bro's load balancing mechanism to scale it to higher throughput.

Re: How to push Snort, Bro, YAF log to Metron

New Contributor

Hi @nallen

Thank you. I install YAF, Snort on other nodes. How to push log data to Metron.

Can you help me?

Re: How to push Snort, Bro, YAF log to Metron

New Contributor

I build YAF on node1 and Metron on node2. How to push YAF event to Metron? Can you suggest for me?