2 ms·
So for those interested Mozilla is working on something pretty similar. https://mozdef.readthedocs.io/en/latest/ https://mozdef.readthedocs.io/en/latest/ They
by DeepYogurt 7y ago
So for those interested Mozilla is working on something pretty similar.
https://mozdef.readthedocs.io/en/latest/ https://mozdef.readthedocs.io/en/latest/
They have a set of docker containers which I find very handy for spinning up deploy specific logging sinks or full on SIEMs.
- PenguinCoder 7y agoJust heard about this today at reinforce conf. Looks pretty interesting and integrates well with cloud logs or on prem. Definitely going to look into it more.
- DeepYogurt 7y agoJust a heads up; there are some rough edges. That said to get it going you can just do a pull and then a `make run`. It's got zero auth in this mode, but if it's ephemeral whatever.