Bro IDS Zeek Explained - platiumsecnet/psnNIDS GitHub Wiki
Bro IDS/Zeek Explained
1. What is BroIDS
Bro, which was renamed Zeek in late 2018 and is sometimes referred to as Bro-IDS or now Zeek-IDS, is a bit different than Snort and Suricata. In a way, Bro is both a signature and anomaly-based IDS. Its analysis engine will convert traffic captured into a series of events. An event could be a user login to FTP, a connection to a website or practically anything. The power of the system is what comes after the event engine and that's the Policy Script Interpreter. This policy engine has its own language (Bro-Script) and it can do some very powerful and versatile tasks.
If you're an analyst and you've wondered "How can I automate some of my work?" then this is the tool you've been looking for. Want to download files seen on the wire, submit them for malware analysis, notify you if a problem is found then blacklist the source and shutdown the user's computer who downloaded it? Want to track the usage patterns of a user after they've contacted an IP from a reputation database?
If you're not an analyst then this tool will have a challenging learning curve. Since it was developed as a research tool, it didn't initially focus on things like GUIs, usability, and ease of installation. While it does numerous cool things out of the box many of those things aren't immediately actionable and may be difficult to interpret.
There’s no native GUI but there are third-party open source tools available for a web front end to query and analyze alerts coming from Bro-IDS. Consider ELK stack.
2. Features
- Can detect patterns of activity other IDS systems can not
- Very extensible architecture
- Good community support
- Comprehensive traffic logging and analysis
- Powerful and flexible event-driven scripting language (Bro scripts)
- Deploys on UNIX-style systems, including Linux, FreeBSD, and MacOS
- DNS/FTP/HTTP/IRC/SMTP/SSH/SSL/other protocol support
- Fully passive traffic analysis with network tap or monitoring port
- Real-time and offline analysis
- Cluster-support for large-scale deployments
- Comprehensive IPv6 support
- IDS-style pattern matching
- File extraction
- Analysts can use Bro for automation (file extraction, malware analysis, blacklisting, track usage patterns, research work, etc.)
3. Disadvantages
- Complicated to set up