BroConfiguration - ads8t/security-onion GitHub Wiki
Bro monitors your network traffic and creates logs, such as:
-
TCP/UDP/ICMP connections
-
For more information, see:
https://www.bro.org/sphinx-git/scripts/base/protocols/conn/main.bro.html#type-Conn::Info
-
DNS activity
-
For more information ,see:
https://www.bro.org/sphinx-git/scripts/base/protocols/dns/main.bro.html#type-DNS::Info
-
FTP activity
-
For more information, see:
https://www.bro.org/sphinx-git/scripts/base/protocols/ftp/info.bro.html#type-FTP::Info
-
HTTP requests and replies
-
For more information, see:
https://www.bro.org/sphinx-git/scripts/base/protocols/http/main.bro.html#type-HTTP::Info
-
SSL/TLS handshake info
-
For more information, see:
https://www.bro.org/sphinx-git/scripts/base/protocols/ssl/main.bro.html#type-SSL::Info
-
Bro notices
-
For more information, see:
https://www.bro.org/sphinx-git/scripts/base/frameworks/notice/main.bro.html#type-Notice::Info
...and others, which can be researched here:
https://www.bro.org/sphinx-git/script-reference/log-files.html
As you can see, Bro log data can provide a wealth of information to the analyst, all easily accessible through ELSA.
- You can add your own Intel to
/opt/bro/share/bro/intel/intel.dat
.- When editing
/opt/bro/share/intel/intel.dat
, ensure there are no leading/trailing spaces or lines, and that only (single) tabs are used as field delimiters. - If you experience an error, or do not notice
/nsm/bro/logs/current/intel.log
being generated, try having a look in/nsm/bro/logs/current/reporter.log
for clues. - You may also want to restart Bro after making changes, by running the following command:
sudo nsm_sensor_ps-restart --only-bro
.
- When editing
- To install and configure the Critical Stack Intel Client for use with Bro, please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/CriticalStackIntelClient
/opt/bro/etc/node.cfg
/opt/bro/share/bro/site/local.bro
- You can add custom scripts in
/opt/bro/share/bro/policy/
and then reference the scripts in/opt/bro/share/bro/site/local.bro
.
Below is an example how to do so:
-
Create a new directory under
/opt/bro/share/bro/policy/
.
sudo mkdir /opt/bro/share/bro/policy/custom-scripts
-
Add your custom script(s) and
__load__.bro
to this directory. -
Modify
__load__.bro
to reference the scripts in thecustom-scripts
directory:@load ./script1.bro
@load ./script2.bro
-
Edit
/opt/bro/share/bro/site/local.bro
so that it will load the new scripts in/opt/bro/share/bro/policy/custom-scripts
, by adding@load custom-scripts
at the bottom of the file and saving the file. -
Restart Bro.
sudo nsm_sensor_ps-restart --only-bro
-
Check
/nsm/bro/logs/current/loaded_scripts.log
to see if your custom script(s) has/have been loaded. -
Check
/nsm/bro/logs/current/reporter.log
for clues if your custom script(s) is/are not working as desired.
-To check and see if a Bro script has fired a Notice, go to ELSA, click Notice, and then click "Top Notice Types". Alternatively, check for entries in /nsm/bro/logs/*/notice.log
.
+To check and see if a Bro script has fired a Notice, go to ELSA, click Notice, and then click "Top Notice Types". Alternatively, check for entries in /nsm/bro/logs/current/notice.log
.
PLEASE NOTE: In a distributed deployment, all custom scripts created under /opt/bro/share/bro/policy/
on a master server will be replicated to sensors via Salt, however, they will not be enabled, as /opt/bro/share/bro/site/local.bro
is not replicated. Therefore, you will either need to manually add a reference to the scripts in /opt/bro/share/bro/site/local.bro
, or add additional configuration in /opt/onionsalt/salt/sensor/init.sls
for Salt to replicate this information.
- Make a symlink to
local.bro
:
sudo ln -s /opt/bro/share/bro/site/local.bro /opt/onionsalt/salt/sensor/bro/local.bro
Then add the following to /opt/onionsalt/salt/sensor/init.sls
:
localbro:
file.managed:
- name: /opt/bro/share/bro/site/local.bro
- source: salt://sensor/bro/local.bro
Then test, using:
sudo salt "SENSOR" state.highstate
You can then have Bro automatically restart upon a detected change in local.bro
from the master by modifying init.sls
similar to the following:
restart-bro
cmd.wait:
- name: /usr/sbin/nsm_sensor_ps-restart --only-bro