dcode

redef Site::local_nets += { 10.0.0.0/24, 192.168.11.0/24 };
global share_exe_IPs: addr_set;

event smtp_data (c: connection, is_orig: bool, data:string)
{
    for (line in find_all(data, /.*\\\\.*\\.*\.exe/))
    {
        local temp = split_string(line,/\\/);
        local IP = to_addr(temp[2]);
        if ( ! is_local(IP) )

dcode

# requirements.txt.orig is the result of `pip freeze > requirements.txt.orig`
# requirements.txt is the current snapshot of pipe
comm -2 -3 requirements.txt requirements.txt.orig | awk -F= '{ print $1 }' | xargs pip uninstall -y

dcode

diff -u --recursive bro-2.5.orig/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake bro-2.5/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake
--- bro-2.5.orig/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake	2017-05-26 03:15:47.598844347 +0000
+++ bro-2.5/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake	2017-05-26 03:21:44.099990030 +0000
@@ -20,10 +20,18 @@
   OUTPUT_STRIP_TRAILING_WHITESPACE
 )
 
+# Admittedly a hack, but in practice we just need *some* headers
+execute_process(
+  COMMAND bash "-c" "find /usr/src/kernels -print |  grep -E '/include/linux/user.h' | cut -d/ -f5 | sort -u | tail -1"

dcode

#!/bin/bash
# 75-dual-home-routing
# Description: Updates routing tables to allow traffic on dual-homed boxes
# according to the interface it came in on
# Place in /etc/NetworkManager/dispatcher.d/ and update interface name below

IF=$1
STATUS=$2

function update_routing_table() {

dcode

ROCK NSM Beta 0 Notes

dcode

# -*- mode: ruby -*-
# vi: set ft=ruby :

Vagrant.configure("2") do |config|
  config.vm.box = "bento/centos-7.2"

  config.vm.provider "vmware_fusion" do |vmware|
    vmware.linked_clone = true
    #vmware.gui = true
    vmware.vmx["memsize"] = "8192"

dcode

NAME := bro

GIT_REPO   := https://github.com/bro/bro.git
GIT_BRANCH := master
COMMIT0    := $(shell git ls-remote $(GIT_REPO) | grep -E 'refs/heads/$(GIT_BRANCH)$$' | cut -f1)
SHORTCOMMIT0 := $(shell echo $(COMMIT0)| awk '{ print substr($$0, 1, 7)}')

VERSION ?=$(shell cat VERSION | cut -d- -f1)
RELEASE ?=$(shell cat VERSION | cut -d- --complement -f1 | tr -d '-')
SNAPSHOT := .git$(SHORTCOMMIT0)

dcode

## Setup Kafka output
@load Bro/Kafka/logs-to-kafka.bro

redef Kafka::topic_name = "bro";
redef Kafka::json_timestamps = JSON::TS_ISO8601;
redef Kafka::tag_json = T;

## Setup event extension to include sensor and probe name
type Extension: record {
    ## The name of the system that wrote this log. This

dcode

                                              ┌─────────────┐  ┌─────────────┐ ┌─────────────┐                                          
                                              │             │  │             │ │             │                                          
                                              │ Master Node │  │ Master Node │ │ Master Node │                                          
                                              │             │  │             │ │             │                                          
                                              └─────────────┘  └─────────────┘ └─────────────┘                                          
                                                                                                                                        
                                                              node.master: true                                                         
┌─────────────┐                                               nod

dcode

alias bro-fields="awk -vOFS='\n' '/^#fields/ { for ( i = 2 ; i<= NF; i++) print \$i }'"