Loading...
This project builds an OSQuery module libbro.so for loading bro logs as tables in osquery. The logs are dynamically loaded into tables from the bro logs installation directory. They are created as tables based on their log file name, except pre-pended with bro_. E.g., conn.log -> table bro_conn. Example From EnvDB UI: Building and Installing To build, you need cmake, clang, git (for both osquery and module builds). make deps make This will create the module ./build/src/libbro.<dylib|so> You will then need to copy this to /usr/local/lib/libbro.<dylib|so> and then you can add an entry to /etc/osquery/modules.load: $ sudo cp -r ./build/src/libbro.<dylib|so> /usr/local/lib $ sudo mkdir -p /etc/osquery/ $ sudo sh -c 'echo "/usr/local/lib/libbro.<so|dylib>" >> /etc/osquery/modules.load' You can now run osqueryi with the location of $BROLOGS set to the bro logs path, where it will attempt to load log tables from $BROLOGS. Example: $ sudo BROLOGS="$PWD/bro/logs" osqueryi Without BROLOGS set, it will try to load logs from the following common Bro installation locations: /usr/local/bro/logs/current /opt/bro/logs /nsm/bro/logs/current Installing for EnvDB To get it to work with EnvDB,
Common questions about bro-osquery-module including features, pricing, alternatives, and user reviews.
bro-osquery-module is A module for loading Bro logs as tables in Osquery. It is a Security Operations solution designed to help security teams with Osquery, Log Management.
ZAT is a Python package that processes and analyzes Zeek network security data using machine learning libraries like Pandas, scikit-learn, Kafka, and Spark.
A tool that collects and displays user activity and system events on a Windows system.
ALEAPP is a Python-based forensic tool for parsing Android logs, events, and protobuf data with both CLI and GUI interfaces.
GrokEVT is a tool for reading Windows event log files and converting them to a human-readable format.
Get strategic cybersecurity insights in your inbox