Adding LDAP or any zeek script to SO

[oneCrazyAdmin]

Good afternoon All,

I have been trying to figure out how to add LDAP to the zeek configuration. I have read through the SO docs but can't quite grasp if I need to add the zeek LDAP script to the SO instance, and if so, where to put it and how to add it correctly to the SO configuration in zeek > config > local > load

I have tried just adding protocols/ldap to the list, but I get
worker-1-1 scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 48: can't find protocols/ldap

I am currently running version 2.4.10

Thanks for any and all help!

[InfosecGoon]

I don't believe you can add parsers to Zeek, because they would need to be included in the so-zeek container image. Do you have a link to this LDAP parser?

[oneCrazyAdmin]

It looks like it is part of the standard zeek implementation. Zeek-LDAP

[InfosecGoon]

I don't think that was added until Zeek 6.1 -- Security Onion currently ships with 6.0.8. It should be added when the Zeek container is next updated for the platform.

[oneCrazyAdmin]

Very good! I will wait patiently.