[Bro] Question about data format of ssl.log files
jessebowling at gmail.com
Wed Feb 20 11:11:48 PST 2013
So quite a few infosec folks are looking at Mandiant's APT1 report, myself
included...When I saw that they included some information on SSL certs in
use I thought "Oh, I'll bet I can check my Bro logs for that!".
Unfortunately, I don't see a way to correlate the info from these reports
with my Bro logs (which is pretty vanilla).
So I suppose my question(s) is/are:
*Has anyone else seen a reliable way to correlate the report data with Bro
*How might I change my Bro logs so that if I were given this info in the
future I could reliably correlate it?
I'm fairly ignorant about how much of an X509 cert one can see on the wire;
serial number seemed promising but is only "required" to be unique per CA,
Signature Algorithm seems promising, as does Public Key Modulus...
Any suggestions/thoughts from the group?
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro