old_contents:
# Copyright (C) 2016, Missouri Cyber Team
# All Rights Reserved
# See the file "LICENSE" in the main distribution directory for details

module ROCK;

export {
  const sensor_id = "sensor001-001" &redef;
}

# Load integration with Snort on ROCK
@load ./frameworks/files/unified2-integration

# Load integration with FSF
@load ./frameworks/files/extract2fsf

# Load file extraction
@load ./frameworks/files/extraction
redef FileExtract::prefix = "/data/bro/logs/extract_files/";
redef FileExtract::default_limit = 1048576000;

# Add GeoIP info to conn log
@load ./misc/conn-add-geoip

# Add worker information to conn log
@load ./misc/conn-add-worker

new_contents:
# Copyright (C) 2016, Missouri Cyber Team
# All Rights Reserved
# See the file "LICENSE" in the main distribution directory for details

module ROCK;

export {
  const sensor_id = "sensor001-001" &redef;
}

# Load integration with Snort on ROCK
@load ./frameworks/files/unified2-integration

# Load integration with FSF
@load ./frameworks/files/extract2fsf

# Load file extraction
@load ./frameworks/files/extraction
redef FileExtract::prefix = "/data/bro/logs/extract_files/";
redef FileExtract::default_limit = 1048576000;

# Configure Kafka output
# Bro Kafka Output (plugin must be loaded!)
@load Kafka/KafkaWriter/logs-to-kafka
redef KafkaLogger::topic_name = "bro_raw";
redef KafkaLogger::sensor_name = ROCK::sensor_id;

# Add GeoIP info to conn log
@load ./misc/conn-add-geoip

# Add worker information to conn log
@load ./misc/conn-add-worker

subject: Revert "Removes kafka from main config"

message: Revert "Removes kafka from main config"

repos: mocyber/rock-scripts


new_contents:
@load ../__load__.bro

module FileExtraction;

const archive_types: set[string] = { "application/x-rar-compressed",
									"application/x-bzip2",
									"application/gzip",
									"application/x-lzma",
									"application/x-lzip",
									"application/x-xz",
									"application/x-lzop",
									"application/x-compress",
									"application/x-7z-compressed",
									"application/x-ace-compressed",
									"application/vnd.ms-cab-compressed",
									"application/x-gtar",
									"application/zip",
								  };

hook FileExtraction::extract(f: fa_file, meta: fa_metadata) &priority=5
	{
	if ( meta$mime_type in archive_types )
		break;
	}

subject: Add archive formats from upstream.

message: Add archive formats from upstream.


old_contents:
##! Packet source using Napatech

module Napatech;

export {
    ## The size of the software deduplication lru cache
    const dedupe_lru_size = 1024 &redef;
    ## Because applications can share streams, the Host Buffer Allowance
    ## allows an application to consume a portion of the host buffer
    ## before the application stops receiving traffic.
    ## For Bro, you most likely want to set this to 100
    const host_buffer_allowance = 100 &redef;
}

new_contents:
##! Packet source using Napatech

module Napatech;

export {
    ## Should the plugin try to deduplicate packets with the color1
    ## value of the DYN4 packet descriptor?
    const enable_software_deduplication = T &redef;
    ## The size of the software deduplication lru cache
    const dedupe_lru_size = 1024 &redef;
    ## Because applications can share streams, the Host Buffer Allowance
    ## allows an application to consume a portion of the host buffer
    ## before the application stops receiving traffic.
    ## For Bro, you most likely want to set this to 100
    const host_buffer_allowance = 100 &redef;
}

subject: Add default value for enable_software_deduplication

repos: hosom/bro-napatech,hosom/bro-napatech