From d235650dc0fcfafc7bf94e523119ec1f8995a281 Mon Sep 17 00:00:00 2001
From: maldwg <maxludwig3@t-online.de>
Date: Wed, 8 Jul 2026 15:52:44 +0200
Subject: [PATCH] Bump Zeek to newest version

---
 config.yaml                                  | 2 +-
 docker/docker-compose.yml                    | 4 +++-
 docker/docker_swarm/docker-compose.swarm.yml | 5 +++--
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/config.yaml b/config.yaml
index 012d7e4..f061e25 100644
--- a/config.yaml
+++ b/config.yaml
@@ -282,7 +282,7 @@ pipeline:
   zeek:
     sensors:
       zeek:
-        static_analysis: true
+        static_analysis: false
         protocols:
           - dns
         interfaces:
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 6e04515..fe96204 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -142,12 +142,14 @@ services:
     profiles: ["prod", "prod-gpu"]
 
   zeek:
-    image: "${HAMSTRING_IMAGE_REGISTRY:-ghcr.io/astraos-de}/hamstring-zeek:${HAMSTRING_ZEEK_IMAGE_TAG:-2.0.1}"
+    image: "${HAMSTRING_IMAGE_REGISTRY:-ghcr.io/astraos-de}/hamstring-zeek:${HAMSTRING_ZEEK_IMAGE_TAG:-2.0.4}"
     cap_add:
       - NET_ADMIN
+      - NET_RAW
     network_mode: host
     environment:
       - CONTAINER_NAME=zeek
+      - HAMSTRING_ZEEK_KAFKA_WAIT_INTERVAL_SECONDS=${HAMSTRING_ZEEK_KAFKA_WAIT_INTERVAL_SECONDS:-5}
     volumes:
       - ../config.yaml:/opt/config.yaml
       - ../data/test_pcaps/:/opt/static_files
diff --git a/docker/docker_swarm/docker-compose.swarm.yml b/docker/docker_swarm/docker-compose.swarm.yml
index 2a09209..f1dfdf7 100644
--- a/docker/docker_swarm/docker-compose.swarm.yml
+++ b/docker/docker_swarm/docker-compose.swarm.yml
@@ -357,11 +357,11 @@ services:
           - "${ALERTER_PLACEMENT_CONSTRAINT:-node.platform.os == linux}"
       restart_policy:
         condition: any
-
   zeek:
-    image: "${HAMSTRING_IMAGE_REGISTRY:-ghcr.io/astraos-de}/hamstring-zeek:${HAMSTRING_ZEEK_IMAGE_TAG:-2.0.1}"
+    image: "${HAMSTRING_IMAGE_REGISTRY:-ghcr.io/astraos-de}/hamstring-zeek:${HAMSTRING_ZEEK_IMAGE_TAG:-2.0.4}"
     cap_add:
       - NET_ADMIN
+      - NET_RAW
     networks:
       - host
     volumes:
@@ -371,6 +371,7 @@ services:
       # Kafka endpoints for host-networked Zeek come from config.yaml:
       # environment.kafka_brokers[*].node_ip/external_port.
       CONTAINER_NAME: "${ZEEK_CONTAINER_NAME:-zeek}"
+      HAMSTRING_ZEEK_KAFKA_WAIT_INTERVAL_SECONDS: "${HAMSTRING_ZEEK_KAFKA_WAIT_INTERVAL_SECONDS:-5}"
     deploy:
       mode: replicated
       replicas: ${ZEEK_REPLICAS:-1}