bro-osquery-module Logo

bro-osquery-module

0
Free
Visit Website

This project builds an OSQuery module libbro.so for loading bro logs as tables in osquery. The logs are dynamically loaded into tables from the bro logs installation directory. They are created as tables based on their log file name, except pre-pended with bro_. E.g., conn.log -> table bro_conn. Example From EnvDB UI: Building and Installing To build, you need cmake, clang, git (for both osquery and module builds). make deps make This will create the module ./build/src/libbro.<dylib|so> You will then need to copy this to /usr/local/lib/libbro.<dylib|so> and then you can add an entry to /etc/osquery/modules.load: $ sudo cp -r ./build/src/libbro.<dylib|so> /usr/local/lib $ sudo mkdir -p /etc/osquery/ $ sudo sh -c 'echo "/usr/local/lib/libbro.<so|dylib>" >> /etc/osquery/modules.load' You can now run osqueryi with the location of $BROLOGS set to the bro logs path, where it will attempt to load log tables from $BROLOGS. Example: $ sudo BROLOGS="$PWD/bro/logs" osqueryi Without BROLOGS set, it will try to load logs from the following common Bro installation locations: /usr/local/bro/logs/current /opt/bro/logs /nsm/bro/logs/current Installing for EnvDB To get it to work with EnvDB,

FEATURES

ALTERNATIVES

PFQ v6.2 is a functional framework for Linux optimized for efficient packet capture/transmission and in-kernel processing.

A specialized packet sniffer for displaying and logging HTTP traffic, designed to capture, parse, and log traffic for later analysis.

A DNS rebinding toolkit

6Guard is an IPv6 attack detector sponsored by Google Summer of Code 2012 and supported by The Honeynet Project organization.

Fail2ban is a daemon that scans log files and bans IPs showing malicious signs to protect servers from brute-force attacks.

Visualize and analyze network relationships with AfterGlow

A tool for extracting common indicators of compromise from a block of text.

Libnids is an implementation of an E-component of Network Intrusion Detection System that emulates the IP stack of Linux 2.0.x and offers IP defragmentation, TCP stream assembly, and TCP port scan detection.