ghost911-s / docker-zeek Goto Github PK

$ docker images

REPOSITORY           TAG          SIZE
blacktop/zeek        latest       65.6MB
blacktop/zeek        4.1          65.6MB
blacktop/zeek        4.0          41.6MB
blacktop/zeek        3.2          41.6MB
blacktop/zeek        3.1          39MB
blacktop/zeek        3.0          39MB
blacktop/zeek        elastic      129MB
blacktop/zeek        kafka        70.7MB
blacktop/zeek        zeekctl      84MB

$ wget https://github.com/blacktop/docker-zeek/raw/master/pcap/heartbleed.pcap
$ wget https://github.com/blacktop/docker-zeek/raw/master/3.0/local.zeek
$ docker run --rm \
         -v `pwd`:/pcap \
         -v `pwd`/local.zeek:/usr/local/zeek/share/zeek/site/local.zeek \
         blacktop/zeek -r heartbleed.pcap local "Site::local_nets += { 192.168.11.0/24 }"

$ ls -l

-rw-r--r--  1 blacktop  staff   635B Jul 30 12:11 conn.log
-rw-r--r--  1 blacktop  staff   754B Jul 30 12:11 files.log
-rw-r--r--  1 blacktop  staff   384B Jul 30 12:11 known_certs.log
-rw-r--r--  1 blacktop  staff   239B Jul 30 12:11 known_hosts.log
-rw-r--r--  1 blacktop  staff   271B Jul 30 12:11 known_services.log
-rw-r--r--  1 blacktop  staff    17K Jul 30 12:11 loaded_scripts.log
-rw-r--r--  1 blacktop  staff   1.9K Jul 30 12:11 notice.log <====== NOTICE
-rw-r--r--  1 blacktop  staff   253B Jul 30 12:11 packet_filter.log
-rw-r--r--  1 blacktop  staff   1.2K Jul 30 12:11 ssl.log
-rw-r--r--  1 blacktop  staff   901B Jul 30 12:11 x509.log

$ cat notice.log | awk '{ print $11 }' | tail -n4

Heartbleed::SSL_Heartbeat_Attack
Heartbleed::SSL_Heartbeat_Odd_Length
Heartbleed::SSL_Heartbeat_Attack_Success