bro-osquery-module Logo

bro-osquery-module

0
Free
Visit Website

This project builds an OSQuery module libbro.so for loading bro logs as tables in osquery. The logs are dynamically loaded into tables from the bro logs installation directory. They are created as tables based on their log file name, except pre-pended with bro_. E.g., conn.log -> table bro_conn. Example From EnvDB UI: Building and Installing To build, you need cmake, clang, git (for both osquery and module builds). make deps make This will create the module ./build/src/libbro.<dylib|so> You will then need to copy this to /usr/local/lib/libbro.<dylib|so> and then you can add an entry to /etc/osquery/modules.load: $ sudo cp -r ./build/src/libbro.<dylib|so> /usr/local/lib $ sudo mkdir -p /etc/osquery/ $ sudo sh -c 'echo "/usr/local/lib/libbro.<so|dylib>" >> /etc/osquery/modules.load' You can now run osqueryi with the location of $BROLOGS set to the bro logs path, where it will attempt to load log tables from $BROLOGS. Example: $ sudo BROLOGS="$PWD/bro/logs" osqueryi Without BROLOGS set, it will try to load logs from the following common Bro installation locations: /usr/local/bro/logs/current /opt/bro/logs /nsm/bro/logs/current Installing for EnvDB To get it to work with EnvDB,

FEATURES

ALTERNATIVES

A Bluetooth 5 and 4.x sniffer using TI CC1352/CC26x2 hardware with advanced features and Python-based host-side software.

Bluetooth experimentation framework for Broadcom chips firmware interaction and update.

LogRhythm NetMon is a network traffic analytics tool that provides real-time visibility, automated threat detection, and investigation capabilities for organizational networks.

A library for integrating communication channels with the Cobalt Strike External C2 server.

Fast passive subdomain enumeration tool

A free DNS recursive service that blocks malicious host names and protects user privacy.

A KDE Plasma 4 widget that displays real-time traffic information for active network connections on Linux computers.

A proof-of-concept for an adaptive parallelised DNS prober