Note: While "Zeek" is the new name of the project, directories, service files, and binaries still (for now) retain the "bro" name.
Zeek (the artist formerly known as Bro) is used to provide network protocol analysis within ROCK. It is extremely customizable, and it is encouraged that you take advantage of this.
When deploying custom Zeek scripts, please be sure to store them under a
/usr/share/bro/site/scripts/. We can't guarantee that your
customizations won't be overwritten by Ansible if you don't follow this pattern.
Zeek is deployed as a systemd unit, called
bro.service. Normal systemd procedures
sudo systemctl start bro sudo systemctl status bro sudo systemctl stop bro sudo systemctl restart bro
broctl command is now an alias. Using this alias prevents dangerous
permission changes caused by running the real broctl binary with sudo. The only
safe way otherwise to run
broctl is to execute it as the
bro user and
group as such:
sudo -u bro -g bro /usr/bin/broctl
- Application Logs