Category: Security Onion Forward Node
Security Onion 2.4.30, Zeek 6.0.2, and single IPv4 address in $HOME_NET
If Zeek on your forward node (sensor) keeps restarting and its detailed status never changes from “health: starting,” to simply “healthy,” have a look at zeek.config.networks.HOME_NET in the Grid Configuration.
Read More → Security Onion 2.4.30, Zeek 6.0.2, and single IPv4 address in $HOME_NET