Skip to content

Instantly share code, notes, and snippets.

@sethhall
sethhall / corelight-logs.schema.json
Created Feb 14, 2022
Corelight Software Sensor Logs JSON Schema
View corelight-logs.schema.json
{
"$schema": "http://json-schema.org/draft-07/schema#",
"$id": "https://corelight.com/software-sensor.schema.json",
"title": "Corelight Logs",
"description": "Definition of all of the potential logs for this installation",
"definitions": {
"time": {"type": "string", "pattern": "[0-9]{4}-[0-1][0-9]-[0-3][0-9]T[0-2][0-9]:[0-5][0-9]:[0-5][0-9]\\.?[0-9]{0,6}Z"},
"port": {"type": "integer", "minimum": 0, "maximum": 65535},
"count": {"type": "integer", "minimum": 0, "maximum": 18446744073709551615},
"int": {"type": "integer", "minimum": -9223372036854775807, "maximum": 9223372036854775807},
@sethhall
sethhall / bu-everywhere.zeek
Created Dec 15, 2020
Business Unit everywhere
View bu-everywhere.zeek
##! Add Business Unit to all logs with an "id" field.
module BusinessUnit;
export {
option BusinessUnit::networks: table[subnet] of string = set();
}
redef record conn_id += {
## The business unit seen as the connection originator.
@sethhall
sethhall / gist:b23ebe5e73c9585fbbdff3628f53b6ae
Last active Dec 9, 2020
A "next interval" function from Justin Azoff
View gist:b23ebe5e73c9585fbbdff3628f53b6ae
function next_interval(i: interval): interval
{
local now = current_time();
local ii = double_to_count(interval_to_double(i));
local sofar = double_to_count(time_to_double(now)) % ii;
local togo = ii - sofar;
local dur = double_to_interval(togo);
return dur;
}
@sethhall
sethhall / mandelbrot.zeek
Created Sep 17, 2020
Mandelbrot fractal set! Probably want the script compiler for this one...
View mandelbrot.zeek
const stdout = open("/dev/stdout") &raw_output;
const WIDTH = 80;
const HEIGHT = 25;
const characters = vector(" ", ".", ":", "-", "#", "o", "*", ">");#, ")", #, "|", "&", "I", "H", "%", "*", "#");
function CalculateRow(y: double, factor: double, shiftRight: double)
{
local output: vector of string = vector();
local XCenter = -0.45;
@sethhall
sethhall / http-more-files-names.bro
Created Aug 23, 2018
Get some extra file names from http
View http-more-files-names.bro
redef record HTTP::Info += {
potential_fname: string &optional;
};
event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string) &priority=5
{
# Get rid of uri arguments
local path = split_string(c$http$uri, /\?/)[0];
@sethhall
sethhall / http-title-ripper.bro
Created Jul 24, 2013
Rip titles out of web pages and add it to a title field in http.log
View http-title-ripper.bro
@load base/protocols/http
module HTTPTitleRipper;
export {
## The depth to search for titles in HTTP response bodies.
const search_depth = 10000;
redef record HTTP::Info += {
## A title from the webpage.
@sethhall
sethhall / myextract.bro
Last active Feb 17, 2020
File extraction special naming example.
View myextract.bro
redef record fa_file += {
is_my_extractor_going: bool &default=F;
};
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( !f$is_my_extractor_going )
{
f$is_my_extractor_going=T;
if ( f$source == "HTTP" && is_orig == F )
@sethhall
sethhall / http-header-logs.bro
Created Aug 5, 2013
Log HTTP headers and values
View http-header-logs.bro
##! Extract and include the header names used for each request in the HTTP
##! logging stream. The headers in the logging stream will be stored in the
##! same order which they were seen on the wire.
@load base/protocols/http/main
module HTTP;
export {
redef record Info += {
@sethhall
sethhall / myextract-with-domain.bro
Created Jan 2, 2014
Example for Bro file extraction with domain name in the filename if the file was grabbed over HTTP.
View myextract-with-domain.bro
redef record fa_file += {
is_my_extractor_going: bool &default=F;
};
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( !f$is_my_extractor_going )
{
f$is_my_extractor_going=T;
if ( f$source == "HTTP" && is_orig == F )