Zeek / Suricata NDR
The Zeek / Suricata NDR connector (zeek_suricata, category ndr) pulls Zeek notice + Suricata eve.json alerts and normalizes each into the AiSOC alert shape, mapping the source severity onto the five-tier ladder (info | low | medium | high | critical).
Setup
- In Connectors -> Add connector, choose Zeek / Suricata NDR.
- Fill in the connection fields shown in the wizard (endpoint URL + API token; secrets are stored in the credential vault, never in plaintext).
- Click Test connection to verify credentials, then Save. The in-process scheduler begins polling on the default cadence.
Events flow through ingest (OCSF normalize) -> Kafka -> fusion, where detections fire and alerts are auto-triaged (copilot).
Configuration reference
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
engine | Sensor engine | select | yes | — | one of: suricata, zeek |
spool_url | Spool URL | string | yes | — | — |
api_token | Spool token | secret | yes | — | encrypted at rest |
verify_tls | Verify TLS certificate | boolean | no | True | — |
Credential handling
api_token is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API. See credential vault.