[Bro] Issue when adding a field to files.log

Daniel Thayer dnthayer at illinois.edu
Fri Sep 11 22:33:29 PDT 2015


What is most likely happening is that by the time your
external program returns its result, the log record has
already been written (without the cuckoo_id value) to files.log.


On 09/11/2015 09:45 PM, Boreham-Smith wrote:
> Hi All,
>
> I have written a script that extracts filetypes of interest, submits the
> extracted file to the cuckoo sandbox, and records the cuckoo task_id. I
> currently store this information successfully in the notice log, but
> would like to add an optional field to the files.log to store this task_id.
>
> I have confirmed that I can add and populate the new files.log field
> with static values, but if I attempt to do this when calling an external
> program to handle the cuckoo submission (ie I use the 'when' block
> below), the value is not output in the log. The print statement within
> the when block, and notice.log output confirms the value is being
> populated, it is just not being written to files.log.
>
> Any suggestions on what I might be doing incorrectly?
>
> I have provided what I think are the relevant code extracts below, but
> am happy to provide more detail if that will assist:
>
> # Add the new field to the files.log
>
> redef record Files::Info += {
>      cuckoo_id: int &optional &log;
> };
>
> # Function that returns the cuckoo task_id
> function submit_cuckoo(f: fa_file): int
> {
>          local command = Exec::Command($cmd=fmt("%s
> extract_files/%s",tool,f$info$extracted));
>          return when ( local result = Exec::run(command)){
>              local id: int  = to_int(result$stdout[0]);
>              return id;
>          }
> }
>
> # Populate the new field
> event file_state_remove( f: fa_file )
> {
>      if (f$info?$extracted) {
>          when ( local id = submit_cuckoo(f) ){
>              f$info$cuckoo_id = id;
>              print fmt("Cuckoo ID value set: %d", f$info$cuckoo_id);
>              NOTICE([$note=File::Cuckoo_Submission,
>                      $msg=fmt("https://cuckoo/analysis/%s
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__cuckoo_analysis_-25s&d=AwMGaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=Bi5qPBnY0NmYPqnRTPj_AfXQKpfQTZUpCzpfFBcawv0&m=ae24aZX-BlkOV69c9Alc2GQYRcmqia6ijosigglu5aM&s=uTipFhJT472EtdFuf9enkoihzQS0Hvht3uFGYtii2Bw&e=>",
> f$info$cuckoo_id),
>                      $f=f]);
>          }
>      }
> }
>
>
> # files.log extract
> #fields ts      fuid    tx_hosts        rx_hosts        conn_uids
> source  depth   analyzers       mime_type       filename
> duration        local_orig      is_orig       seen_bytes
> total_bytes     missing_bytes   overflow_bytes  timedout
> parent_fuid     md5     sha1    sha256  extracted       cuckoo_id
> #types  time    string  set[addr]       set[addr]       set[string]
> string  count   set[string]     string  string  interval        bool
> bool    count   count   countcount    bool    string  string  string
> string  string  int
> 1441526348.202595       FtBY2c3CsMMNsBdAil      192.168.1.xxx
> 192.168.1.yyy   CKkqBYszNpSR6Bgaf       HTTP    0       EXTRACT
> application/msword      -       0.108599     -F       616960  616960
> 0       0       F       -       -       -       -
> HTTP-FtBY2c3CsMMNsBdAil.doc     -
>
> # notice.log extract
> #fields ts      uid     id.orig_h       id.orig_p       id.resp_h
> id.resp_p       fuid    file_mime_type  file_desc       proto   note
> msg     sub     src     dst  pn       peer_descr      actions
> suppress_for    dropped remote_location.country_code
> remote_location.region  remote_location.city
> remote_location.latitude        remote_location.longitude
> #types  time    string  addr    port    addr    port    string  string
> string  enum    enum    string  string  addr    addr    port    count
> string  set[enum]       interval      bool    string  string  string
> double  double
> 1441526362.215942       CKkqBYszNpSR6Bgaf       192.168.1.yyy   33805
> 192.168.1.xxx   80      FtBY2c3CsMMNsBdAil      application/msword
> http://192.168.1.xxx/files/test.doc
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__192.168.1.xxx_files_test.doc&d=AwMGaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=Bi5qPBnY0NmYPqnRTPj_AfXQKpfQTZUpCzpfFBcawv0&m=ae24aZX-BlkOV69c9Alc2GQYRcmqia6ijosigglu5aM&s=C_rjh_HibNWOcOyptdaUavr_Ktn6wRtFVNCaq_cYAW4&e=>
> tcp     File::Cuckoo_Submission https://cuckoo/analysis/80
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__cuckoo_analysis_80&d=AwMGaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=Bi5qPBnY0NmYPqnRTPj_AfXQKpfQTZUpCzpfFBcawv0&m=ae24aZX-BlkOV69c9Alc2GQYRcmqia6ijosigglu5aM&s=mhE5lNaIUBpgobeJZf9rZ9XlwD8p_Bjky-V2i9eheD8&e=>
> -       192.168.1.yyy   192.168.1.xxx   80      -       bro
> Notice::ACTION_LOG      3600.000000  F-       -       -       -       -
>
> -------
> regards,
>
> Boreham
>
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>


More information about the Bro mailing list