How to push Snort, Bro, YAF log to Metron

[#1]

Hi everyone.

I configured Apache Metron full dev 0.3 but I don't push Snort, Bro, Yaf log to Metron Server. Can you help me?

[#2]

As of version 0.3.1 we implemented sensor-stubs, which pushes sample bro, snort, and yaf data into metron by default when you spin up full-dev. Can you try that version instead? That would be the easiest way to see data in your full-dev cluster, and you can find the relevant information about the sensor-stubs here.

If you are pinned to 0.3.0 for some reason, you should be able to put bro logs onto the bro topic, snort logs onto the snort topic, or yaf logs onto the yaf topic in order to get them ingested, and then properly validate by running curl against elasticsearch (or just by looking in kibana). To push them onto those topics there are a lot of options, but you may want to look into some of the simple kafka producer scripts included in full-dev under /usr/hdp/current.

[#3]

Hi @Jon Zeolla. Thank you for your answer.

I set up separate servers Snort, YAF, Bro. How to I ingest log from that servers into metron?

[#4]

Install the Metron Bro plugin into your Bro install. This will push the Bro output into Kafka so that Metron can consume it.

• https://github.com/apache/metron/tree/master/metron-sensors/bro-plugin-kafka

You can use the Ansible deployment steps as instructions for one, simple way to pipe YAF and Snort output into Kafka. This is only suitable for small scale testing.

• https://github.com/apache/metron/tree/master/metron-deployment/roles/yaf
• https://github.com/apache/metron/tree/master/metron-deployment/roles/snort

You're going to want to use something `yafzcbalance` for scaling YAF to higher throughput.

• https://tools.netsa.cert.org/yaf/yafzcbalance.html

You can use Bro's load balancing mechanism to scale it to higher throughput.

• https://www.bro.org/documentation/load-balancing.html

[#5]

Hi @nallen

Thank you. I install YAF, Snort on other nodes. How to push log data to Metron.

Can you help me?

[#6]

I build YAF on node1 and Metron on node2. How to push YAF event to Metron? Can you suggest for me?