[Bro] BRO hourly summary connectivity reports - geoip?

Justin Azoff JAzoff at albany.edu
Mon Nov 11 07:20:53 PST 2013

On Mon, Nov 11, 2013 at 09:57:16AM -0500, Konrad Weglowski wrote:
> Hello,
> Is there a way to customize/add items that are e-mailed as a part of the BRO
> hourly connection summary reports? I would like to add geoip lookups for
> example?

frameworks/notice/actions/add-geodata.bro does this.

you just need to do something like:

redef Notice::lookup_location_types += {

or write a notice hook that adds ACTION_ADD_GEODATA to all notices.
which means taking this:

hook policy(n: Notice::Info) &priority=10
    if ( n$note in Notice::lookup_location_types )
        add n$actions[ACTION_ADD_GEODATA];

and adding one of your own like

hook policy(n: Notice::Info) &priority=10
    add n$actions[ACTION_ADD_GEODATA];

-- Justin Azoff
-- Network Security & Performance Analyst

More information about the Bro mailing list