Zeek Log Transport¶

Before proceeding, you should have:

• AC-Hunter installed and running (see AC-Hunter Installation)
• Zeek deployed and generating logs on the sensor host (see Zeek Configuration)

Zeek sensors write logs locally; for AC-Hunter to import them, those logs must be delivered to the AC-Hunter server via SFTP. The recommended approach is to use ZeekShip, a lightweight agent that runs alongside Zeek and automatically ships rotated log files to AC-Hunter.

There are three ways to get Zeek logs to your AC-Hunter server, listed from most recommended to least:

1. ZeekShip as a Docker container (recommended): best when Docker is available (e.g., you are running the AC-Hunter docker-based Zeek install)
2. ZeekShip as a system service: best for standalone Zeek installs without Docker
3. Manual SSH/SFTP transport: last resort only

Setup Overview¶

Setting up log transport involves work on two machines (the Zeek sensor and the AC-Hunter server) in the following order:

1. Open firewall ports on the AC-Hunter server (see Firewall Requirements)
2. Install ZeekShip on the Zeek sensor (see ZeekShip Docker Install or ZeekShip Service Install); the installer generates an SSH key pair
3. Copy ZeekShip's public key to the AC-Hunter server and start the SFTP receiver (see Enabling the AC-Hunter SFTP Receiver)
4. Configure and start ZeekShip on the sensor to begin shipping logs

The sections below follow this order. Each ZeekShip install section will direct you back to the receiver setup at the right time.

Firewall Requirements¶

The AC-Hunter server must be reachable from your Zeek sensors on the port used for log transport. Which port depends on your transport method:

Confirm that any host-based firewalls (e.g. firewalld, ufw, iptables) and network firewalls between the sensor and AC-Hunter server allow the relevant port before proceeding with the ZeekShip or SFTP setup below.

ZeekShip Docker Install¶

This is the recommended method for getting Zeek logs to AC-Hunter. If Docker is available on the Zeek sensor host (for example, if you are running the AC-Hunter docker-based Zeek install), you can run ZeekShip as a Docker container.

Install¶

The ZeekShip Docker installer is included in the download bundle (see Download the Install Bundle). Copy it to the Zeek sensor host, then extract and run the installer:

tar -xzf zeekship-docker-v1.0.0.tar.gz
cd zeekship-docker-v1.0.0/
sudo ./install.sh

The installer will:

1. Load the ZeekShip Docker image
2. Place docker-compose.yml and the default config at /etc/zeekship/
3. Generate an SSH key pair at /var/lib/zeekship/keys/
4. Place the zeekship script in /usr/local/bin

Next: Before configuring or starting ZeekShip, switch to the AC-Hunter server and complete Enabling the AC-Hunter SFTP Receiver. Add the public key you just copied and bring up the SFTP receiver. Then come back here to configure and start ZeekShip.

Configure¶

Edit the config file and set the AC-Hunter server address:

sudo vim /etc/zeekship/config.hjson

At minimum, set sftp.host to the IP or hostname of your AC-Hunter server. You should also set sensor_name to identify this sensor — if left blank, ZeekShip will use the machine's hostname, which may not produce a useful name inside a Docker container.

{
    "sensor_name": "zeek_hq_01"        // optional; defaults to hostname if blank
    "sync": {
        "logs_root": "/opt/zeek/logs"  // verify this matches your Zeek logs directory
    },
    "sftp": {
        "host": "ach.example.com"      // set to your AC-Hunter server IP or hostname
    }
}

Start¶

zeekship up -d --force-recreate

Verify¶

zeekship logs -f

Upgrade¶

Re-run the installer with a newer release. Existing config and keys are preserved.

Uninstall¶

sudo ./uninstall.sh

ZeekShip Service Install¶

For hosts running Zeek natively without Docker, ZeekShip can be installed as a systemd service that continuously watches your Zeek log directories and uploads rotated logs to AC-Hunter over SFTP.

Install¶

The ZeekShip service installer is included in the download bundle (see Download the Install Bundle). Copy it to the Zeek sensor host, then extract and run the installer:

tar -xzf zeekship-v1.0.0.tar.gz
cd zeekship-v1.0.0/
sudo ./install.sh

The installer will:

1. Install the zeekship binary to /usr/local/bin/zeekship
2. Create a default config at /etc/zeekship/config.hjson
3. Generate an SSH key pair at /var/lib/zeekship/keys/
4. Install and enable the zeekship systemd service

Next: Before configuring or starting ZeekShip, switch to the AC-Hunter server and complete Enabling the AC-Hunter SFTP Receiver. Add the public key you just copied and bring up the SFTP receiver. Then come back here to configure and start ZeekShip.

Configure¶

Edit the config file and set the AC-Hunter server address:

sudo vim /etc/zeekship/config.hjson

At minimum, set sftp.host to the IP or hostname of your AC-Hunter server. You should also set sensor_name to identify this sensor — if left blank, ZeekShip will use the machine's hostname.

{
    "sensor_name": "zeek_hq_01"        // optional; defaults to hostname if blank
    "sync": {
        "logs_root": "/opt/zeek/logs"  // verify this matches your Zeek logs directory
    },
    "sftp": {
        "host": "ach.example.com"      // set to your AC-Hunter server IP or hostname
    }
}

The default config reference is available at /etc/zeekship/config.hjson.default.

Start¶

sudo systemctl start zeekship

Verify¶

journalctl -u zeekship -f

You should see ZeekShip connecting to the AC-Hunter server and beginning to upload logs.

Key Config Options¶

Upgrade¶

Re-run the installer with a newer release. Existing config and SSH keys are preserved:

tar -xzf zeekship-v1.0.0.tar.gz
cd zeekship-v1.0.0/
sudo ./install.sh

Uninstall¶

sudo ./uninstall.sh

Enabling the AC-Hunter SFTP Receiver¶

Before any sensor can ship logs, you must enable the SFTP receiver on the AC-Hunter server. This runs as an optional Docker service managed by the hunt command.

Starting the Receiver¶

1. Add the sensor's public key to the AC-Hunter server. Use the public key that was printed at the end of the ZeekShip installation (also available at /var/lib/zeekship/keys/zeekship_ed25519.pub on the sensor). Copy it to the AC-Hunter server:

   # Create a file named after this sensor (any name ending in .pub)
   sudo cp zeekship_ed25519.pub /etc/AC-Hunter/sftp/public_keys/sensor01.pub
   

   The receiver requires at least one .pub key file before it will start.
2. Start the remote-logs service:

   hunt remote-logs up -d
   

3. Verify it is running:

   hunt remote-logs status
   

Next: Return to your ZeekShip install section (Docker or Service) to configure and start ZeekShip.

Managing the Receiver¶

Once enabled, the receiver will automatically restart with hunt up and hunt restart.

Corelight SFTP Export¶

Corelight sensors already produce Zeek-format logs and ship them with their own built-in SFTP export, so you do not install ZeekShip on a Corelight sensor. Instead, point Corelight's export at the AC-Hunter SFTP receiver — from AC-Hunter's perspective, Corelight is just another sensor delivering logs over port 2222.

On the AC-Hunter server¶

This is the same setup as for any sensor (see Enabling the AC-Hunter SFTP Receiver):

1. Add Corelight's export public key to the AC-Hunter server:

   sudo cp corelight_export.pub /etc/AC-Hunter/sftp/public_keys/corelight.pub
   

2. Start the receiver:

   hunt remote-logs up -d
   

In Corelight's export configuration¶

Point the export at your AC-Hunter server with these settings:

After the export is running, confirm logs are arriving in the AC-Hunter UI for the sensor name you configured.

Manual SSH/SFTP Transport¶

If you cannot use ZeekShip, you can set up your own mechanism to deliver Zeek logs to AC-Hunter. There are two options:

Option A: Use the AC-Hunter SFTP Receiver (port 2222)¶

This uses the containerized SFTP receiver described in Enabling the AC-Hunter SFTP Receiver.

• The AC-Hunter SFTP receiver must be running
• Connect via SFTP to port 2222 on the AC-Hunter server
• Authenticate as user zeekdrop using SSH key authentication
• Upload logs to the /upload directory

Logs must be organized by date under the upload directory:

/upload/<sensor_name>/YYYY-MM-DD/<log_files>

For example:

/upload/zeek_hq_01/2026-03-05/conn.12:00:00-13:00:00.log.gz
/upload/zeek_hq_01/2026-03-05/dns.12:00:00-13:00:00.log.gz

Example session:

sftp -P 2222 -i /path/to/private_key [email protected]
sftp> cd /upload
sftp> mkdir my_sensor
sftp> cd my_sensor
sftp> mkdir 2026-03-05
sftp> cd 2026-03-05
sftp> put *.log.gz

Option B: Direct SSH to the AC-Hunter Host (port 22)¶

If you do not want to use the SFTP receiver container at all, you can transfer logs directly to the AC-Hunter host using standard SSH/SCP/SFTP on port 22. The logs simply need to land in the correct directory on the AC-Hunter server:

/opt/zeek/remotelogs/<sensor_name>/YYYY-MM-DD/<log_files>

For example:

scp *.log.gz [email protected]:/opt/zeek/remotelogs/my_sensor/2026-03-05/

This requires that you have standard SSH access to the AC-Hunter host and appropriate filesystem permissions. The SFTP receiver container does not need to be running for this method.

Option C: Other Transport Methods¶

Any mechanism that delivers Zeek logs to the AC-Hunter server will work, as long as the files end up in the correct directory:

/opt/zeek/remotelogs/<sensor_name>/YYYY-MM-DD/<log_files>

Examples include mounting an S3 bucket, using a log shipper like Vector, rsync, or any other file transfer tool. The directory structure and file format must match what Zeek produces.

With any manual option, you would need to configure and manage the transport yourself, handle retries, and track which files have already been uploaded. This is why ZeekShip is strongly recommended.