Skip to content

Instantly share code, notes, and snippets.

@J-Gras J-Gras/do_notice.bro
Last active Mar 29, 2016

Embed
What would you like to do?
Extends the original do_notice.bro to add an identifier to the notices.
# Extends the original script to add an identifier to the notices.
# Jan Grashoefer (jan.grashoefer@gmail.com)
# Original script is shipped with Bro.
@load base/frameworks/intel
@load base/frameworks/notice
module Intel;
export {
redef enum Notice::Type += {
## Intel::Notice is a notice that happens when an intelligence
## indicator is denoted to be notice-worthy.
Intel::Notice
};
redef record Intel::MetaData += {
## A boolean value to allow the data itself to represent
## if the indicator that this metadata is attached to
## is notice worthy.
do_notice: bool &default=F;
## Restrictions on when notices are created to only create
## them if the *do_notice* field is T and the notice was
## seen in the indicated location.
if_in: Intel::Where &optional;
};
}
event Intel::match(s: Seen, items: set[Item])
{
for ( item in items )
{
if ( item$meta$do_notice &&
(! item$meta?$if_in || s$where == item$meta$if_in) )
{
local n = Notice::Info($note=Intel::Notice,
$msg = fmt("Intel hit on %s at %s", s$indicator, s$where),
$sub = cat("Indicator = ", s$indicator));
if ( s?$conn )
{
n$conn = s$conn;
# Add identifier composed of indicator, originator's and responder's IP,
# without considering the direction of the flow.
local intel_id = s$indicator;
if( s$conn?$id )
{
if( s$conn$id$orig_h < s$conn$id$resp_h)
intel_id = cat(intel_id, s$conn$id$orig_h, s$conn$id$resp_h);
else
intel_id = cat(intel_id, s$conn$id$resp_h, s$conn$id$orig_h);
}
n$identifier = intel_id;
}
# Add additional information to the generated mail
local srv_str = "";
for ( srv in s$conn$service )
srv_str = cat(srv_str, srv, " ");
local mail_ext = vector(
fmt("Service: %s\n", srv_str),
fmt("Intel source: %s\n", item$meta$source));
n$email_body_sections = mail_ext;
NOTICE(n);
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.