[jira] [Commented] (METRON-1914) Upgrade the bro sensor in full-dev to latest

["Jon Zeolla (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/METRON-1914?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16824482#comment-16824482 ] 

Jon Zeolla commented on METRON-1914:
------------------------------------

Since there is talk about moving full-dev to centos7, which greatly simplifies what we need to do to upgrade bro, I am adding a dependency to this task.

> Upgrade the bro sensor in full-dev to latest
> --------------------------------------------
>
>                 Key: METRON-1914
>                 URL: https://issues.apache.org/jira/browse/METRON-1914
>             Project: Metron
>          Issue Type: Improvement
>            Reporter: Jon Zeolla
>            Assignee: Jon Zeolla
>            Priority: Minor
>
> Bro 2.6 and 2.6.1 have been released, we should support it by default.  We should maintain backwards compatability at least to 2.5.
> Note regarding metron-bro-plugin-kafka:
> In docker/in_docker_scripts/configure_bro_plugin.sh:41, this will error with bro 2.6 and newer, and generally isn't a very clean appraoch. In 2.6, the DHCP framework was reworked and known-devices-and-hostnames.bro no longer exists (zeek/zeek@e76b56c#diff-cdafd4a1100bf5b58e63223c5d25a906). This command was initially made as a hack to test Metron ES support for bro 2.5.5 logs. I suggest we figure out what the right approach here is - don't have anything off the top of my head right now.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)