pcap_to_zeek: Process a PCAP with Zeek and create Parquet files
In hrbrmstr/zeekr: Tools to Make Analyses Using Zeek Easier

Description Usage Arguments Value Note Examples

View source: R/pcap_to_zeek.R

Process a PCAP with Zeek and create Parquet files

1	pcap_to_zeek(pcap, out_dir = tempfile(pattern = "zeek"), zeek_opts = c(), ...)

`pcap`	path to PCAP to process. (`path.expand()` will be called on this value)
`out_dir`	path to Parquet files. (`path.expand()` will be called on this value) If the directory does not exist it will be created. If ho directory is specified a temporary directory will be created and used. You should call `unlink()` on this path if you used a temporary directory.
`zeek_opts`	extra options passed to to Zeek command line. NOTE: `--no-checksums`, `LogAscii::use_json=T`, and `Log::default_scope_sep='_'` are already handled by this function; no need to specify them.
`...`	extra named parameters passed on to `arrow::write_parquet()`

length 1 character vector of the expanded path of the out_dir

the zeek binary must be available on PATH. You can use the environment variable ZEEK_PATH as a hint where find_zeek() will look for the zeek binary.

loc <- tryCatch(
  pcap_to_zeek(system.file("pcap/ssh.pcap", package = "zeekr")),
  error = function(e) message("No Zeek")
)

if (!is.null(loc)) {
  read_zeek_logs(loc)
  unlink(loc) # don't do this IRL until you're done working with or saving.
}