eZeeKonfigurator v1.0

Abstract

eZeeKonfigurator is a web application and supporting tools for configuring Zeek (formerly Bro) systems. Zeek is an open-source tool developed at LBNL that's used to secure computer networks. A recent version of Zeek introduced the configuration framework, where changes can be made while the system is running. However, the provided method is difficult to operationalize, as it requires a set of text files to be deployed and updated across all the Zeek systems. eZeeKonfigurator provides an easy-to-use web interface to this. Users can view and modify options in a web application, and then those changes are deployed to the desired Zeek systems. Additionally, users benefit from additional features, such as: * Logging and auditing, to determine who made what change and when * Automated expiration of changes (e.g. an exception is added for 2 weeks, after which time it will be removed) * Validation of changes and verification that the change has been applied * Fine-grained role-based access