bro-osquery-module
This project builds an OSQuery module libbro.so for loading bro logs as tables in osquery. The logs are dynamically loaded into tables from the bro logs installation directory. They are created as tables based on their log file name, except pre-pended with bro_. E.g., conn.log -> table bro_conn. Example From EnvDB UI: Building and Installing To build, you need cmake, clang, git (for both osquery and module builds). make deps make This will create the module ./build/src/libbro.<dylib|so> You will then need to copy this to /usr/local/lib/libbro.<dylib|so> and then you can add an entry to /etc/osquery/modules.load: $ sudo cp -r ./build/src/libbro.<dylib|so> /usr/local/lib $ sudo mkdir -p /etc/osquery/ $ sudo sh -c 'echo "/usr/local/lib/libbro.<so|dylib>" >> /etc/osquery/modules.load' You can now run osqueryi with the location of $BROLOGS set to the bro logs path, where it will attempt to load log tables from $BROLOGS. Example: $ sudo BROLOGS="$PWD/bro/logs" osqueryi Without BROLOGS set, it will try to load logs from the following common Bro installation locations: /usr/local/bro/logs/current /opt/bro/logs /nsm/bro/logs/current Installing for EnvDB To get it to work with EnvDB,
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
A blog sharing packet capture files and malware samples for training and analysis, with archived posts and traffic analysis exercises.
Tcpreplay is a suite of Open Source utilities for editing and replaying captured network traffic.
A suite for man in the middle attacks, featuring sniffing of live connections, content filtering, and protocol dissection.
NBD (Network Block Device) is a network protocol implementation that allows clients to access remote block devices over a network as if they were local storage.
Unfurl is a URL analysis tool that extracts and visualizes data from URLs, breaking them down into components and presenting the information visually.
pfSense is a leading open source firewall and network security solution, providing advanced protection and connectivity options.
Tor Browser is a free and open-source software that allows users to browse the internet anonymously and privately.
Snort is an open source intrusion prevention system that uses rules to detect and prevent malicious network activity.
PINNED
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.