Migrating from AC-Hunter v6 to v7¶

AC-Hunter v7 is a substantial change from v6: a new database backend (ClickHouse), a new container architecture, and a new log transport agent (ZeekShip). This guide is the roadmap for moving an existing v6 deployment to v7.

What is changing in v7¶

• The AC-Hunter server runs on a new ClickHouse backend and installs on a fresh OS.
• ZeekShip replaces the v6 rsync-based log transport.
• docker-zeek can optionally move to the Zeek 8 image.

Before you start¶

What does and doesn't migrate:

• Historical analysis data: doesn't migrate.
• User accounts: don't migrate. You create a new admin account on first login.
• Safelist: migrates, with a conversion step.
• Sensors: stay in place. Only the way they deliver logs changes.

Inventory your sensors. For each one, note which Zeek it runs: docker-zeek, Security Onion, Corelight, or a native Zeek install. This decides your ZeekShip install path in step 3 and whether the optional docker-zeek upgrade applies to you.

Have ready: your list of internal subnets, and any custom certificate files you use.

Confirm your new server meets the hardware and OS requirements.

How the migration works¶

v7 installs on a fresh, separate machine. Your v6 system keeps running untouched throughout, so it stays your fallback if you need it.

The approach: stand up v7 alongside v6, point your sensors at v7, confirm v7 is working, then retire v6 on your own schedule.

v7 starts with no historical data. Expect about a day of runtime before you have a full 24 hours of data to work with.

Migration at a glance¶

1. Stand up the v7 AC-Hunter server¶

1. Follow the AC-Hunter Installation guide on the new host, including creating the first-run admin account.
2. Enable the SFTP receiver on port 2222. Your sensors will ship logs to it in step 3.

2. Set your configuration¶

Set this in the config file before you connect any sensors.

1. Open /etc/AC-Hunter/config.hjson.
2. Set internal_subnets to your internal IP ranges in CIDR notation (for example 10.0.0.0/8, 192.168.0.0/16). AC-Hunter uses these to tell internal traffic from external, so getting them right up front means your data is classified correctly from the first import.
3. (Optional) Add custom threat intel feeds under threat_intel. Skip this if you use the default feeds. See Threat Intelligence Feeds for the feed format and options.

4. Apply the config (see Applying Configuration Changes):

   hunt load-config

3. Install ZeekShip on each sensor¶

ZeekShip is the v7 log transport. Install it on each sensor, point it at the v7 server, and it ships Zeek logs over SFTP. Do this once per sensor.

1. Install ZeekShip on the sensor. Pick the path that matches it:

   • ZeekShip Docker install for sensors already running Docker (docker-zeek).
   • ZeekShip Service install for Security Onion or native Zeek.

   Either installer generates an SSH key and prints the public key. Copy it.

2. Add that public key to the v7 server's SFTP receiver. See Enabling the AC-Hunter SFTP Receiver.

3. Configure ZeekShip:

   • Set sftp.host to your AC-Hunter v7 server.
   • Set sensor_name to the name this sensor used in v6, so its data stays under one sensor in the UI. v7 lowercases names and converts spaces and hyphens to underscores, so the displayed name may differ slightly.
   • Set sync.logs_root to wherever this sensor writes its Zeek logs.

4. Start ZeekShip and confirm logs are arriving, both on the sensor (zeekship logs -f or journalctl -u zeekship -f) and in the v7 UI.

5. (Optional) Once ZeekShip is confirmed working, remove the old v6 rsync transport on this sensor. The v6 installer set it up as a cron job running a zeek_log_transport.sh rsync wrapper.

   Confirm nothing's still running first

   Before deleting anything, check that no transport is in flight: crontab -l (as the user that ran the v6 installer) and pgrep -af zeek_log_transport should both come up empty.

   Remove the cron entry and transport script (the bro_ names cover older installs):

   sudo rm -f /etc/cron.d/zeek_log_transport /etc/cron.d/bro_log_transport
   sudo rm -f /usr/local/bin/zeek_log_transport.sh /usr/local/bin/bro_log_transport.sh
   sudo systemctl reload cron 2>/dev/null || sudo systemctl reload crond 2>/dev/null || true
   

   Optionally remove the SSH keypair and lock files the old transport used (in the home directory of whichever user ran the v6 installer), and drop the stale known_hosts entry for the retired server:

   rm -f ~/.ssh/id_rsa_dataimport ~/.ssh/id_rsa_dataimport.pub
   rm -f ~/rsync_log_transport.*.lck
   ssh-keygen -R <old_v6_server>
   

   Once nothing on the sensor is talking to port 22 of the retired v6 server, you can close port 22 on your firewall for the sensor-to-server path. ZeekShip uses port 2222.

Espy servers¶

If you run Espy, treat the Espy server as just another sensor: it produces Zeek-format logs that ZeekShip ships to the v7 server. You don't need to install Zeek or docker-zeek on it.

• Espy writes Zeek TSV logs to /opt/zeek/logs/YYYY-MM-DD/ with hourly rotation — exactly the layout ZeekShip expects, so you can leave sync.logs_root at its default of /opt/zeek/logs.
• Espy already runs Docker, so use the ZeekShip Docker install.

Follow the same steps as for any sensor: install ZeekShip, add its public key to the SFTP receiver, set sftp.host to the v7 server, and pick a clear sensor_name (such as espy_hq) so Espy-sourced data is easy to tell apart in the UI. Confirm logs are flowing, then decommission the old transport.

4. Verify the migration¶

Before you rely on v7, confirm:

• Logs are arriving from each sensor.
• The v7 UI is showing and scoring your real data, not just the sample dataset.
• If you forward alerts, a syslog test reaches your receiver (hunt syslog-alert-ping).

Finish setup in the web UI¶

These can be done any time after cutover, in any order.

Migrate your safelist. Convert your exported v6 safelist, then import it. See Upgrading Safelists from AC-Hunter v6.

Set up syslog alerting (only if you forward alerts to a SIEM or log tool). Configure it under Settings > Alerts; see Syslog Alerting. The alert format changed in v7, so update any v6 parsers, dashboards, or rules:

Optional: upgrade docker-zeek¶

Skip this section unless your sensors run docker-zeek. Security Onion, Corelight, and native Zeek users don't need it.

Existing docker-zeek sensors keep producing logs that v7 imports, so this isn't required. Upgrading brings the Zeek 8 image, the new zeek CLI, and cleaner volume handling.

For the upgrade procedure and the cleanup of old v6 package volumes, see Updating Zeek and Migrating from older versions.

If you hit trouble, email support@activecountermeasures.com.