Let’s say you’re using Bro, and you have this bad assed app called ELSA to search through the mountains of logs produced.
You find exactly what you’re looking for but you need the payload from the stream.
One option is to integrate ELSA and Moloch. It’s super easy.
edit /etc/elsa_web.conf and add this somewhere in the file.
“moloch_urls”: {
“https://YOURIP:8005”: {
“start”: “10.X.X.0”,
“end”: “10.X.X.255”
}
},
Then edit /usr/local/elsa/web/lib/Controller.pm
and change the pcap_url section to the following.
if ($self->conf->get(‘pcap_url’) or $self->conf->get(‘streamdb_url’) or $self->conf->get(‘streamdb_urls’) or $self->conf->get(‘moloch_urls’)){
Restart apache and you can invoke Moloch from the info link in ELSA.
Then it’ll pull that session with timestamp in Moloch.
Make sure you have NTP setup.
0 Comments