You migrate to Zeek (Bro) Gold parser and use 'server_name' in your rules, The 'server_name' field is mapped to the '_name' UDM field. As part of the migration, ensure that the rules, searches,ĭashboards, or other processes that depend on the original fields use the updated fields.įor example, in the default parser, the 'server_name' field is mapped to the The changes in field mappings between the default parser and Gold parser

The Chronicle parser supports the following Zeek versions:īefore you use the Zeek (Bro) Gold parser, review Verify the Zeek versions that the Chronicle parser supports. The following diagram shows how you can configure a NXLog agent and a Chronicleįorwarder on a Linux server and forward log data to Chronicle. Representation and might be more complex. Each customer deployment might differ from this To understand the components deployed to collect Zeek logs, review theĭeployment architecture. The information in this document applies to the parser with the BRO_JSON ingestion label. This document alsoĮxplains how Zeek log fields map to Chronicleįor an overview about Chronicle data ingestion, see Data ingestion to Chronicle.Īn ingestion label identifies the parser which normalizes raw log data

With Chronicle to collect Zeek logs in JSON format. This document describes how you can deploy Zeek (formerly Bro) and NXLog Save money with our transparent approach to pricing Rapid Assessment & Migration Program (RAMP) Migrate from PaaS: Cloud Foundry, OpenshiftĬOVID-19 Solutions for the Healthcare Industry

Netcontrol chrome