[Bro] How should I be calling an external script from Bro?
Azoff, Justin S
jazoff at illinois.edu
Mon Mar 14 14:03:42 PDT 2016
Hi,
This repo has code in it that does everything you are trying to do:
https://github.com/ncsa/bhr-bro
You should be able to see how to modify it for your environment.
This video details how the Exec works:
https://www.youtube.com/watch?v=oo4zDC24xHU
--
- Justin Azoff
> On Mar 14, 2016, at 4:48 PM, Eric Hacecky <hacecky at jlab.org> wrote:
>
> New to Bro. Trying to make sure I follow best practice here configuring it for my environment.
>
> Currently Bro generates an email alert for HTTP::SQL_Injection_Attacker from detect-sqli.bro.
>
> I wrote a python script to accept some parameters, including the attacker's IP that will put in a block at my firewall.
>
> I was just going to tail Bro's notice.log and pull out the IP to feed my script anytime a SQL attack was logged there, but I figured it would be better to get Bro to do some of that lifting for me instead.
>
> Being new to bro, I don't know how to do this.
>
> I've googled around a bit and this is my best guess. (definitely a guess)
>
> - Exec module is the best way to go about this?
>
> - If so, I'm going to do what...make a something.bro file that basically says
>
> @load base/utils/exec
>
> when ( <something indicating SQL_Injection_Attacker> happens = Exec::run($cmd="myScript.py 55.66.77.88 -time 720") )
>
> - Then I would @load something.bro in my local.bro file
>
> -----------
>
> Assuming that's the gist of it, how am I supposed to figure out what event to look for?
>
> when ( HTTP::SQL_Injection_Attacker )?
>
> Every example I look at has uses 'local result' instead. Ex. https://github.com/sooshie/bro-scripts/blob/master/misc/vt_check.bro
>
> when (local result = Exec::run). Why? I don't see result defined anywhere previously? I don't understand how that condition is ever met.
>
> How do I make bro pass the IP to my script?
>
> Exec::run($cmd="myScript.py [$host=c$id$orig_h]")?
>
> Thanks,
> Eric
>
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
More information about the Bro
mailing list