bro-scripts: ntp-audit.bro: changed alert msg to match purpose

# Written by Jon Schipp
# Detects when hosts send NTP queries to NTP servers not defined in time_servers.
# 	To use:
# 		1. Add script to configuration local.bro: $ echo '@load ntp-audit.bro' >> $BROPREFIX/share/bro/site/local.bro
# 		2. Copy script to $BROPREFIX/share/bro/site
# 		3. $ broctl check && broctl install && broctl restart

@load base/frameworks/notice

# List your NTP servers here
const time_servers: set[addr] = {
	192.168.1.250,
	192.168.1.251,
} &redef;

# List any source addresses that should be excluded
const time_exclude: set[addr] = {
	192.168.1.250,
	192.168.1.251,
	192.168.1.1, # Gateway/NAT
} &redef;

export {

        redef enum Notice::Type += {
                NTP::Query_Sent_To_Wrong_Server
        };
}

redef Notice::emailed_types += {
                NTP::Query_Sent_To_Wrong_Server
};

event udp_request(u: connection)
        {
        if ( u$id$orig_h !in time_exclude && u$id$resp_h !in time_servers && u$id$resp_p == 123/udp )
                {
                NOTICE([$note=NTP::Query_Sent_To_Wrong_Server,
                $msg="NTP query destined to non-defined NTP servers", $conn=u,
                $identifier=cat(u$id$orig_h),
                $suppress_for=1day]);
                }
        }

# Written by Jon Schipp
# Detects when hosts send NTP queries to NTP servers not defined in time_servers.
# 	To use:
# 		1. Add script to configuration local.bro: $ echo '@load ntp-audit.bro' >> $BROPREFIX/share/bro/site/local.bro
# 		2. Copy script to $BROPREFIX/share/bro/site
# 		3. $ broctl check && broctl install && broctl restart

@load base/frameworks/notice

# List your NTP servers here
const time_servers: set[addr] = {
	192.168.1.250,
	192.168.1.251,
} &redef;

# List any source addresses that should be excluded
const time_exclude: set[addr] = {
	192.168.1.250,
	192.168.1.251,
	192.168.1.1, # Gateway/NAT
} &redef;

export {

        redef enum Notice::Type += {
                NTP::Query_Sent_To_Wrong_Server
        };
}

redef Notice::emailed_types += {
                NTP::Query_Sent_To_Wrong_Server
};

event udp_request(u: connection)
        {
        if ( u$id$orig_h !in time_exclude && u$id$resp_h !in time_servers && u$id$resp_p == 123/udp )
                {
                NOTICE([$note=NTP::Query_Sent_To_Wrong_Server,
                $msg="NTP query destined to non-TOC NTP servers", $conn=u,
                $identifier=cat(u$id$orig_h),
                $suppress_for=1day]);
                }
        }


don't need to change priority

don't need to change priority

@load http-ext

module HTTP;

export {
    const local_domains = /(^|\.)albany\.edu($|:)/ &redef;
}

event http_ext(id: conn_id, si: http_ext_session_info)
{
    if(is_local_addr(id$resp_h) && local_domains !in si$host) {
        si$force_log = T;
        add si$force_log_reasons["external_name"];
    }
}

@load http-ext

module HTTP;

export {
    const local_domains = /(^|\.)albany\.edu($|:)/ &redef;
}

event http_ext(id: conn_id, si: http_ext_session_info) &priority=10
{
    if(is_local_addr(id$resp_h) && local_domains !in si$host) {
        si$force_log = T;
        add si$force_log_reasons["external_name"];
    }
}


Update detect-shellshock.bro

Update detect-shellshock.bro

Added contact information.

# Monitors traffic for Shellshock exploit attempts
# When exploits are seen containing IP addresses and domain values, monitors traffic for 60 minutes watching for endpoints to connect to IP addresses and domains seen in exploit attempts
# CrowdStrike 2014
# josh.liburdi@crowdstrike.com

@load base/frameworks/notice
@load base/protocols/http
@load base/protocols/dhcp

module CrowdStrike;

export {
  redef enum Notice::Type += {
    Shellshock_DHCP,
    Shellshock_HTTP,
    Shellshock_Successful_Conn
  };
}

const shellshock_pattern = /(\(|%28)(\)|%29)( |%20)(\{|%7B)/ &redef;

const shellshock_commands = /wget/ | /curl/;

global shellshock_servers: set[addr] &create_expire=60min &synchronized;
global shellshock_hosts: set[string] &create_expire=60min &synchronized;

# function to locate and extract domains seen in shellshock exploit attempts
function find_domain(ss: string)
{
local parts1 = split_all(ss,/[[:space:]]/);
for ( p in parts1 )
  if ( "http" in parts1[p] )
    {
    local parts2 = split_all(parts1[p],/\//);
    local output = parts2[5];
    }

if ( output !in shellshock_hosts )
  add shellshock_hosts[output];
}

# function to locate and extract IP addresses seen in shellshock exploit attempts
function find_ip(ss: string): bool
{
local b = F;
local remote_servers = find_ip_addresses(ss);

if ( |remote_servers| > 0 )
  {
  b = T;
  for ( rs in remote_servers )
    {
    local s = to_addr(remote_servers[rs]);
    if ( s !in shellshock_servers )
      add shellshock_servers[s];
    }
  }

return b;
}

# event to identify shellshock HTTP exploit attempts
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
{
if ( ! is_orig ) return;
if ( shellshock_pattern !in value ) return;

# generate a notice of the HTTP exploit attempt
NOTICE([$note=Shellshock_HTTP,
        $conn=c,
        $msg=fmt("Host %s may have attempted a shellshock HTTP exploit against %s", c$id$orig_h, c$id$resp_h),
        $sub=fmt("Command: %s",value),
        $identifier=cat(c$id$orig_h,c$id$resp_h,value)]);

# check the exploit attempt for IP addresses
# if an IP address is found, then do not look for domains
if ( find_ip(value) == T ) return;

# check the exploit attempt for domains
if ( shellshock_commands in value )
  find_domain(value);
}

# event to identify shellshock DHCP exploit attempts
event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string)
{
if ( shellshock_pattern !in host_name ) return;

# generate a notice of the DHCP exploit attempt
NOTICE([$note=Shellshock_DHCP,
        $conn=c,
        $msg=fmt("Host %s may have attempted a shellshock DHCP exploit against %s", c$id$orig_h, c$id$resp_h),
        $sub=fmt("Command: %s",host_name),
        $identifier=cat(c$id$orig_h,c$id$resp_h,host_name)]);

# check the exploit attempt for IP addresses
# if an IP address is found, then do not look for domains
if ( find_ip(host_name) == T ) return;

# check the exploit attempt for domains
if ( shellshock_commands in host_name )
  find_domain(host_name);
}

# event to identify endpoints connecting to domains seen in shellshock exploit attempts
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=5
{
if ( name != "HOST" ) return;
if ( value in shellshock_hosts )
  # generate a notice of HTTP connection to domain seen in exploit attempts
  NOTICE([$note=Shellshock_Successful_Conn,
          $conn=c,
          $msg=fmt("Host %s connected to a domain seen in a shellshock exploit", c$id$orig_h),
          $sub=fmt("Domain: %s",value),
          $identifier=cat(c$id$orig_h,value)]);
}

# event to identify endpoints connecting to IP addresses seen in shellshock exploit attempts
event connection_state_remove(c: connection)
{
if ( c$id$resp_h in shellshock_servers )
  # generate a notice of connection to IP address seen in exploit attempts
  NOTICE([$note=Shellshock_Successful_Conn,
          $conn=c,
          $msg=fmt("Host %s connected to an IP address seen in a shellshock exploit", c$id$orig_h),
          $sub=fmt("IP address: %s",c$id$resp_h),
          $identifier=cat(c$id$orig_h,c$id$resp_h)]);
}

# Monitors traffic for Shellshock exploit attempts
# When exploits are seen containing IP addresses and domain values, monitors traffic for 60 minutes watching for endpoints to connect to IP addresses and domains seen in exploit attempts
# CrowdStrike 2014

@load base/frameworks/notice
@load base/protocols/http
@load base/protocols/dhcp

module CrowdStrike;

export {
  redef enum Notice::Type += {
    Shellshock_DHCP,
    Shellshock_HTTP,
    Shellshock_Successful_Conn
  };
}

const shellshock_pattern = /(\(|%28)(\)|%29)( |%20)(\{|%7B)/ &redef;

const shellshock_commands = /wget/ | /curl/;

global shellshock_servers: set[addr] &create_expire=60min &synchronized;
global shellshock_hosts: set[string] &create_expire=60min &synchronized;

# function to locate and extract domains seen in shellshock exploit attempts
function find_domain(ss: string)
{
local parts1 = split_all(ss,/[[:space:]]/);
for ( p in parts1 )
  if ( "http" in parts1[p] )
    {
    local parts2 = split_all(parts1[p],/\//);
    local output = parts2[5];
    }

if ( output !in shellshock_hosts )
  add shellshock_hosts[output];
}

# function to locate and extract IP addresses seen in shellshock exploit attempts
function find_ip(ss: string): bool
{
local b = F;
local remote_servers = find_ip_addresses(ss);

if ( |remote_servers| > 0 )
  {
  b = T;
  for ( rs in remote_servers )
    {
    local s = to_addr(remote_servers[rs]);
    if ( s !in shellshock_servers )
      add shellshock_servers[s];
    }
  }

return b;
}

# event to identify shellshock HTTP exploit attempts
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
{
if ( ! is_orig ) return;
if ( shellshock_pattern !in value ) return;

# generate a notice of the HTTP exploit attempt
NOTICE([$note=Shellshock_HTTP,
        $conn=c,
        $msg=fmt("Host %s may have attempted a shellshock HTTP exploit against %s", c$id$orig_h, c$id$resp_h),
        $sub=fmt("Command: %s",value),
        $identifier=cat(c$id$orig_h,c$id$resp_h,value)]);

# check the exploit attempt for IP addresses
# if an IP address is found, then do not look for domains
if ( find_ip(value) == T ) return;

# check the exploit attempt for domains
if ( shellshock_commands in value )
  find_domain(value);
}

# event to identify shellshock DHCP exploit attempts
event dhcp_ack(c: connection, msg: dhcp_msg, mask: addr, router: dhcp_router_list, lease: interval, serv_addr: addr, host_name: string)
{
if ( shellshock_pattern !in host_name ) return;

# generate a notice of the DHCP exploit attempt
NOTICE([$note=Shellshock_DHCP,
        $conn=c,
        $msg=fmt("Host %s may have attempted a shellshock DHCP exploit against %s", c$id$orig_h, c$id$resp_h),
        $sub=fmt("Command: %s",host_name),
        $identifier=cat(c$id$orig_h,c$id$resp_h,host_name)]);

# check the exploit attempt for IP addresses
# if an IP address is found, then do not look for domains
if ( find_ip(host_name) == T ) return;

# check the exploit attempt for domains
if ( shellshock_commands in host_name )
  find_domain(host_name);
}

# event to identify endpoints connecting to domains seen in shellshock exploit attempts
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=5
{
if ( name != "HOST" ) return;
if ( value in shellshock_hosts )
  # generate a notice of HTTP connection to domain seen in exploit attempts
  NOTICE([$note=Shellshock_Successful_Conn,
          $conn=c,
          $msg=fmt("Host %s connected to a domain seen in a shellshock exploit", c$id$orig_h),
          $sub=fmt("Domain: %s",value),
          $identifier=cat(c$id$orig_h,value)]);
}

# event to identify endpoints connecting to IP addresses seen in shellshock exploit attempts
event connection_state_remove(c: connection)
{
if ( c$id$resp_h in shellshock_servers )
  # generate a notice of connection to IP address seen in exploit attempts
  NOTICE([$note=Shellshock_Successful_Conn,
          $conn=c,
          $msg=fmt("Host %s connected to an IP address seen in a shellshock exploit", c$id$orig_h),
          $sub=fmt("IP address: %s",c$id$resp_h),
          $identifier=cat(c$id$orig_h,c$id$resp_h)]);
}


Update expand-query.bro

Update expand-query.bro

# Creates a vector from a DNS query
# CrowdStrike 2015
# josh.liburdi@crowdstrike.com
# @jshlbrd

@load base/protocols/dns
@load base/protocols/http

module DNS;

redef record DNS::Info += {
	query_vec:        vector of string  &log &optional;
	query_vec_size:   count             &log &optional;
};

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)
{
	if( c?$dns ) {
		c$dns$query_vec = HTTP::extract_keys(query,/\./);
		c$dns$query_vec_size = |c$dns$query_vec|;
	}
}

# Creates a vector from a DNS query
# CrowdStrike 2015
# josh.liburdi@crowdstrike.com
# @jshlbrd

@load base/protocols/dns
@load base/protocols/http

module DNS;

redef record DNS::Info += {
	query_vec:        vector of string  &log &optional;
	query_vec_size:   count             &log &optional;
};

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count)
{
c$dns$query_vec = HTTP::extract_keys(query,/\./);
c$dns$query_vec_size = |c$dns$query_vec|;
}


commenting out the load conn_asn until we figure out the Geo dependency

Former-commit-id: ee3892e7e106ef391257be567fccea3567f8c80e


Better detection for MS updates.

Better detection for MS updates.

@load global-ext
@load http-ext

@load signatures
redef signature_files += "http-ext-identified-files.sig";

module HTTP;

export {
	redef enum Notice += {
		# This notice is thrown when the file extension doesn't
		# seem to match the file contents.
		HTTP_IncorrectFileType,
	};

	# MIME types that you'd like this script to identify and log.
	const watched_mime_types = /application\/x-dosexec/
	                         | /application\/x-executable/ &redef;

	# URLs included here are not logged and notices are not thrown.
	# Take care when defining regexes to not be overly broad.
	const ignored_urls = /^http:\/\/(au\.|www\.)?download\.windowsupdate\.com\/msdownload\/update/ &redef;

	# Create regexes that *should* in be in the urls for specifics mime types.
	# Notices are thrown if the pattern doesn't match the url for the file type.
	const mime_types_extensions: table[string] of pattern = {
		["application/x-dosexec"] = /\.([eE][xX][eE]|[dD][lL][lL])/,
	} &redef;
}

# Don't delete the http sessions at the end of the request!
redef watch_reply=T;

# Make the default signature action ignore anything beginning with "matchfile"
function default_signature_action(sig: string): SigAction
	{
	if ( /^matchfile-/ in sig )
		return SIG_IGNORE;
	else
		return SIG_ALARM;
	}
redef signature_actions &default=default_signature_action;

# This script uses the file tagging method to create a separate file.
event bro_init()
	{
	# Add the tag for log file splitting.
	LOG::define_tag("http-ext", "identified-files");
	}

event signature_match(state: signature_state, msg: string, data: string)
	{
	# Only signatures matching file types are dealt with here.
	if ( /^matchfile/ !in state$id ) return;

	# Not much point in any of this if we don't know about the
	# HTTP-ness of the connection.
	if ( state$conn$id !in conn_info ) return;

	local si = conn_info[state$conn$id];
	# Set the mime type seen.
	si$mime_type = msg;

	if ( watched_mime_types in msg )
		{
		# Add a tag for logging purposes.
		add si$tags["identified-files"];
		}

	if ( ignored_urls !in si$url &&
	     msg in mime_types_extensions &&
	     mime_types_extensions[msg] !in si$url )
		{
		local message = fmt("%s %s %s", msg, si$method, si$url);
		NOTICE([$note=HTTP_IncorrectFileType,
		        $msg=message,
		        $conn=state$conn,
		        $method=si$method,
		        $URL=si$url]);
		}

	event file_transferred(state$conn, data, "", msg);
	}

@load global-ext
@load http-ext

@load signatures
redef signature_files += "http-ext-identified-files.sig";

module HTTP;

export {
	redef enum Notice += {
		# This notice is thrown when the file extension doesn't
		# seem to match the file contents.
		HTTP_IncorrectFileType,
	};

	# MIME types that you'd like this script to identify and log.
	const watched_mime_types = /application\/x-dosexec/
	                         | /application\/x-executable/ &redef;

	# URLs included here are not logged and notices are not thrown.
	# Take care when defining regexes to not be overly broad.
	const ignored_urls = /^http:\/\/www\.download\.windowsupdate\.com\// &redef;

	# Create regexes that *should* in be in the urls for specifics mime types.
	# Notices are thrown if the pattern doesn't match the url for the file type.
	const mime_types_extensions: table[string] of pattern = {
		["application/x-dosexec"] = /\.([eE][xX][eE]|[dD][lL][lL])/,
	} &redef;
}

# Don't delete the http sessions at the end of the request!
redef watch_reply=T;

# Make the default signature action ignore anything beginning with "matchfile"
function default_signature_action(sig: string): SigAction
	{
	if ( /^matchfile-/ in sig )
		return SIG_IGNORE;
	else
		return SIG_ALARM;
	}
redef signature_actions &default=default_signature_action;

# This script uses the file tagging method to create a separate file.
event bro_init()
	{
	# Add the tag for log file splitting.
	LOG::define_tag("http-ext", "identified-files");
	}

event signature_match(state: signature_state, msg: string, data: string)
	{
	# Only signatures matching file types are dealt with here.
	if ( /^matchfile/ !in state$id ) return;

	# Not much point in any of this if we don't know about the
	# HTTP-ness of the connection.
	if ( state$conn$id !in conn_info ) return;

	local si = conn_info[state$conn$id];
	# Set the mime type seen.
	si$mime_type = msg;

	if ( watched_mime_types in msg )
		{
		# Add a tag for logging purposes.
		add si$tags["identified-files"];
		}

	if ( ignored_urls !in si$url &&
	     msg in mime_types_extensions &&
	     mime_types_extensions[msg] !in si$url )
		{
		local message = fmt("%s %s %s", msg, si$method, si$url);
		NOTICE([$note=HTTP_IncorrectFileType,
		        $msg=message,
		        $conn=state$conn,
		        $method=si$method,
		        $URL=si$url]);
		}

	event file_transferred(state$conn, data, "", msg);
	}


set bro control port bind to 127.0.0.1

set bro control port bind to 127.0.0.1

##! Local site policy. Customize as appropriate.
##!
##! This file will not be overwritten when upgrading or reinstalling!

redef ignore_checksums = T;
redef SSL::disable_analyzer_after_detection = F;

#@load site/sqlite.bro

# This script logs which scripts were loaded during each run.
@load misc/loaded-scripts

# Apply the default tuning scripts for common tuning settings.
@load tuning/defaults
@load tuning/json-logs

# Load the scan detection script.
@load misc/scan

# Log some information about web applications being used by users
# on your network.
@load misc/app-stats

# Detect traceroute being run on the network.
@load misc/detect-traceroute

# Generate notices when vulnerable versions of software are discovered.
# The default is to only monitor software found in the address space defined
# as "local".  Refer to the software framework's documentation for more
# information.
@load frameworks/software/vulnerable

# Detect software changing (e.g. attacker installing hacked SSHD).
@load frameworks/software/version-changes
@load frameworks/software/windows-version-detection

# This adds signatures to detect cleartext forward and reverse windows shells.
@load-sigs frameworks/signatures/detect-windows-shells

# Load all of the scripts that detect software in various protocols.
@load protocols/ftp/software
@load protocols/smtp/software
@load protocols/ssh/software
@load protocols/http/software
# The detect-webapps script could possibly cause performance trouble when
# running on live traffic.  Enable it cautiously.
#@load protocols/http/detect-webapps

# This script detects DNS results pointing toward your Site::local_nets
# where the name is not part of your local DNS zone and is being hosted
# externally.  Requires that the Site::local_zones variable is defined.
@load protocols/dns/detect-external-names

# Script to detect various activity in FTP sessions.
@load protocols/ftp/detect

# Scripts that do asset tracking.
@load protocols/conn/known-hosts
@load protocols/conn/known-services
@load protocols/ssl/known-certs

# This script enables SSL/TLS certificate validation.
@load protocols/ssl/validate-certs

# This script prevents the logging of SSL CA certificates in x509.log
@load protocols/ssl/log-hostcerts-only

# Uncomment the following line to check each SSL certificate hash against the ICSI
# certificate notary service; see http://notary.icsi.berkeley.edu .
# @load protocols/ssl/notary

# If you have libGeoIP support built in, do some geographic detections and
# logging for SSH traffic.
@load protocols/ssh/geo-data
# Detect hosts doing SSH bruteforce attacks.
@load protocols/ssh/detect-bruteforcing
# Detect logins using "interesting" hostnames.
@load protocols/ssh/interesting-hostnames

# Detect SQL injection attacks.
@load protocols/http/detect-sqli

#### Network File Handling ####

# Enable MD5 and SHA1 hashing for all files.
@load frameworks/files/hash-all-files

# Detect SHA1 sums in Team Cymru's Malware Hash Registry.
@load frameworks/files/detect-MHR

# Uncomment the following line to enable detection of the heartbleed attack. Enabling
# this might impact performance a bit.
@load policy/protocols/ssl/heartbleed
redef SSL::disable_analyzer_after_detection = F;
redef Communication::listen_interface = 127.0.0.1;

@load base/protocols/dhcp

##! Local site policy. Customize as appropriate.
##!
##! This file will not be overwritten when upgrading or reinstalling!

redef ignore_checksums = T;
redef SSL::disable_analyzer_after_detection = F;

#@load site/sqlite.bro

# This script logs which scripts were loaded during each run.
@load misc/loaded-scripts

# Apply the default tuning scripts for common tuning settings.
@load tuning/defaults
@load tuning/json-logs

# Load the scan detection script.
@load misc/scan

# Log some information about web applications being used by users
# on your network.
@load misc/app-stats

# Detect traceroute being run on the network.
@load misc/detect-traceroute

# Generate notices when vulnerable versions of software are discovered.
# The default is to only monitor software found in the address space defined
# as "local".  Refer to the software framework's documentation for more
# information.
@load frameworks/software/vulnerable

# Detect software changing (e.g. attacker installing hacked SSHD).
@load frameworks/software/version-changes
@load frameworks/software/windows-version-detection

# This adds signatures to detect cleartext forward and reverse windows shells.
@load-sigs frameworks/signatures/detect-windows-shells

# Load all of the scripts that detect software in various protocols.
@load protocols/ftp/software
@load protocols/smtp/software
@load protocols/ssh/software
@load protocols/http/software
# The detect-webapps script could possibly cause performance trouble when
# running on live traffic.  Enable it cautiously.
#@load protocols/http/detect-webapps

# This script detects DNS results pointing toward your Site::local_nets
# where the name is not part of your local DNS zone and is being hosted
# externally.  Requires that the Site::local_zones variable is defined.
@load protocols/dns/detect-external-names

# Script to detect various activity in FTP sessions.
@load protocols/ftp/detect

# Scripts that do asset tracking.
@load protocols/conn/known-hosts
@load protocols/conn/known-services
@load protocols/ssl/known-certs

# This script enables SSL/TLS certificate validation.
@load protocols/ssl/validate-certs

# This script prevents the logging of SSL CA certificates in x509.log
@load protocols/ssl/log-hostcerts-only

# Uncomment the following line to check each SSL certificate hash against the ICSI
# certificate notary service; see http://notary.icsi.berkeley.edu .
# @load protocols/ssl/notary

# If you have libGeoIP support built in, do some geographic detections and
# logging for SSH traffic.
@load protocols/ssh/geo-data
# Detect hosts doing SSH bruteforce attacks.
@load protocols/ssh/detect-bruteforcing
# Detect logins using "interesting" hostnames.
@load protocols/ssh/interesting-hostnames

# Detect SQL injection attacks.
@load protocols/http/detect-sqli

#### Network File Handling ####

# Enable MD5 and SHA1 hashing for all files.
@load frameworks/files/hash-all-files

# Detect SHA1 sums in Team Cymru's Malware Hash Registry.
@load frameworks/files/detect-MHR

# Uncomment the following line to enable detection of the heartbleed attack. Enabling
# this might impact performance a bit.
@load policy/protocols/ssl/heartbleed
redef SSL::disable_analyzer_after_detection = F;

@load base/protocols/dhcp


Create main.bro

Create main.bro

# Log Tor connections based on IP addresses along with Tor node metadata
# Based on data collected from torstatus.blutmagie.de
# CrowdStrike 2015
# josh.liburdi@crowdstrike.com
# @jshlbrd

module Tor;

export {
	redef enum Log::ID += { TOR::LOG };

	type Info: record {
	## Timestamp for when the event happened.
	ts:               time 	&log;
	## Unique ID for the connection.
	uid:              string &log;
	## The connection's 4-tuple of endpoint addresses/ports.
	id:               conn_id &log;
	## Tor node IP address.
	tor_ip:           addr &log &optional;
	## Tor node router name.
	router_name:      string &log &optional;
	## Tor node host name.
	host_name:        string &log &optional;
	## Tor node platform / version number.
	platform:         string &log &optional;
	## Tor node country code location.
	country_code:     string &log &optional;
	## Tor node bandwidth (in KB/s).
	bandwidth:        count	&log &optional;
	## Tor node estimated uptime.
	uptime:           time	&log &optional;
	## Tor node router port.
	router_port:      count	&log &optional;
	## Tor node directory port.
	directory_port:   count	&log &optional;
	## Tor node auth flag.
	auth_flag:        bool	&log &optional;
	## Tor node exit flag.
	exit_flag:        bool	&log &optional;
	## Tor node fast flag.
	fast_flag:        bool	&log &optional;
	## Tor node guard flag.
	guard_flag:       bool	&log &optional;
	## Tor node named flag.
	named_flag:       bool	&log &optional;
	## Tor node stable flag.
	stable_flag:      bool	&log &optional;
	## Tor node running flag.
	running_flag:     bool	&log &optional;
	## Tor node valid flag.
	valid_flag:       bool	&log &optional;
	## Tor node v2dir flag.
	v2dir_flag:       bool	&log &optional;
	## Tor node hibernating flag.
	hibernating_flag: bool	&log &optional;
	## Tor node bad exit flag.
	bad_exit_flag:    bool	&log &optional;
	};

	## Event that can be handled to access the Tor record as it is sent on
	## to the logging framework.
	global log_tor: event(rec: Info);
}

redef record connection += {
	tor: Info &optional;
};

type tor_idx: record {
	tor_ip:	addr;
};

type tor_table: record {
	router_name:      string;
	country_code:     string;
	bandwidth:        count;
	uptime:           double;
	host_name:        string;
	router_port:      count;
	directory_port:   string;
	auth_flag:        count;
	exit_flag:        count;
	fast_flag:        count;
	guard_flag:       count;
	named_flag:       count;
	stable_flag:      count;
	running_flag:     count;
	valid_flag:       count;
	v2dir_flag:       count;
	platform:         string;
	hibernating_flag: count;
	bad_exit_flag:    count;
};

global torlist: table[addr] of tor_table = table();

# Create the Tor log stream and load the Tor list
event bro_init()
{
Log::create_stream(TOR::LOG, [$columns=Info, $ev=log_tor]);
Input::add_table([$source=torlist_location, $name="torlist", $idx=tor_idx, $val=tor_table, $destination=torlist, $mode=Input::REREAD]);
}

# Function to establish a Tor info record
function set_session(c: connection)
{
if ( ! c?$tor )
	{
	add c$service["tor"];
	c$tor = [$ts=network_time(),$id=c$id,$uid=c$uid];
	}
}

# Function to convert blutmagie Tor flags from count to bool
function convert_flag(flag: count): bool
{
if ( flag == 1 )
	return T;
else return F;
}

# Function to set data in the Tor info record
function set_data(c: connection, tor_ip: addr)
{
c$tor$tor_ip = tor_ip;
if ( torlist[tor_ip]?$router_name )
	c$tor$router_name = torlist[tor_ip]$router_name;
if ( torlist[tor_ip]?$host_name )
	c$tor$host_name = torlist[tor_ip]$host_name;
if ( torlist[tor_ip]?$platform )
	c$tor$platform = torlist[tor_ip]$platform;
if ( torlist[tor_ip]?$country_code )
	c$tor$country_code = torlist[tor_ip]$country_code;
if ( torlist[tor_ip]?$bandwidth )
	c$tor$bandwidth = torlist[tor_ip]$bandwidth;

if ( torlist[tor_ip]?$uptime )
	{
	# Uptime is recorded by hour, so we need to convert it to seconds
	local uptime_hr = torlist[tor_ip]$uptime;
	local uptime_time = ( uptime_hr * 3600 );
	c$tor$uptime = double_to_time(uptime_time);
	}

if ( torlist[tor_ip]?$router_port )
	c$tor$router_port = torlist[tor_ip]$router_port;
if ( torlist[tor_ip]?$directory_port )
	if ( torlist[tor_ip]$directory_port != "None" )
		c$tor$directory_port = to_count(torlist[tor_ip]$directory_port);
if ( torlist[tor_ip]?$auth_flag )
	c$tor$auth_flag = convert_flag(torlist[tor_ip]$auth_flag);
if ( torlist[tor_ip]?$exit_flag )
	c$tor$exit_flag = convert_flag(torlist[tor_ip]$exit_flag);
if ( torlist[tor_ip]?$fast_flag )
	c$tor$fast_flag = convert_flag(torlist[tor_ip]$fast_flag);
if ( torlist[tor_ip]?$guard_flag )
	c$tor$guard_flag = convert_flag(torlist[tor_ip]$guard_flag);
if ( torlist[tor_ip]?$named_flag )
	c$tor$named_flag = convert_flag(torlist[tor_ip]$named_flag);
if ( torlist[tor_ip]?$stable_flag )
	c$tor$stable_flag = convert_flag(torlist[tor_ip]$stable_flag);
if ( torlist[tor_ip]?$running_flag )
	c$tor$running_flag = convert_flag(torlist[tor_ip]$running_flag);
if ( torlist[tor_ip]?$valid_flag )
	c$tor$valid_flag = convert_flag(torlist[tor_ip]$valid_flag);
if ( torlist[tor_ip]?$v2dir_flag )
	c$tor$v2dir_flag = convert_flag(torlist[tor_ip]$v2dir_flag);
if ( torlist[tor_ip]?$hibernating_flag )
	c$tor$hibernating_flag = convert_flag(torlist[tor_ip]$hibernating_flag);
if ( torlist[tor_ip]?$bad_exit_flag )
	c$tor$bad_exit_flag = convert_flag(torlist[tor_ip]$bad_exit_flag);
}

# Generate reporter message when the Tor list is updated
event Input::end_of_data(name: string, source: string)
{
local msg = fmt("Tor list updated at %s",network_time());
Log::write(Reporter::LOG, [$ts=network_time(), $level=Reporter::INFO, $message=msg]);
}

# Check each new connection for an IP address in the Tor list
event new_connection(c: connection )
{
if ( c$id$orig_h in torlist )
	{
	set_session(c);
	set_data(c,c$id$orig_h);
	}
else if ( c$id$resp_h in torlist )
	{
	set_session(c);
	set_data(c,c$id$resp_h);
	}
}

# Generate the tor.log for each Tor connection
event connection_state_remove(c: connection)
{
if ( c?$tor )
	{
	Log::write(TOR::LOG, c$tor);
	}
}

error: pathspec 'bro-scripts/tor/main.bro' did not match any file(s) known to git


typo / signature

typo / signature

@load ./dio_incident_log.bro
@load ./dio_json_log.bro
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef Broker::endpoint_name = "listener";
global dionaea_connection: event(timestamp: time, id: string, local_ip: addr, local_port: count, remote_ip: addr, remote_port: count, transport: string, connector_id: string);
global dionaea_access: event(timestamp: time, dst_ip: addr, dst_port: count, src_hostname: string, src_ip: addr, src_port: count, transport: string, protocol: string, connector_id: string);
global get_protocol: function(proto_str: string) : transport_proto;

event bro_init() {
    print "dionaea_receiver.bro: bro_init()";
    Broker::enable();
    Broker::listen(broker_port, "0.0.0.0");
    Broker::subscribe_to_events("honeypot/dionaea/");
    print "dionaea_receiver.bro: bro_init() done";
}
event bro_done() {
    print "dionaea_receiver.bro: bro_done()";
}

event dionaea_connection(timestamp: time, id: string, local_ip: addr, local_port: count, remote_ip: addr, remote_port: count, transport: string, connector_id: string) {
    local lport: port = count_to_port(local_port, get_protocol(transport));
    local rport: port = count_to_port(remote_port, get_protocol(transport));

    print fmt("dionaea_connection: timestamp=%s, id=%s, local_ip=%s, local_port=%s, remote_ip=%s, remote_port=%s, transport=%s, connector_id=%s", timestamp, id, local_ip, local_port, remote_ip, remote_port, transport, connector_id);
    print fmt("converted ports %s %s", lport, rport);
    local rec: Dio_incident::Info = [$ts=timestamp, $id=id, $local_ip=local_ip, $local_port=lport, $remote_ip=remote_ip, $remote_port=rport, $transport=transport, $connector_id=connector_id];

    Log::write(Dio_incident::LOG, rec);
}

event dionaea_access(timestamp: time, dst_ip: addr, dst_port: count, src_hostname: string, src_ip: addr, src_port: count, transport: string, protocol: string, connector_id: string) {
    local sport: port = count_to_port(src_port, get_protocol(transport));
    local dport: port = count_to_port(dst_port, get_protocol(transport));

    print fmt("dionaea_access: timestamp=%s, dst_ip=%s, dst_port=%s, src_hostname=%s, src_ip=%s, src_port=%s, transport=%s, protocol=%s, connector_id=%s", timestamp, dst_ip, dst_port, src_hostname, src_ip, src_port, transport, protocol, connector_id);
    local rec: Dio_access::Info = [$ts=timestamp, $dst_ip=dst_ip, $dst_port=dst_port, $src_hostname=src_hostname, $src_ip=src_ip, $src_port=src_port, $transport=transport, $protocol=protocol, $connector_id=connector_id];

    Log::write(Dio_access::LOG, rec);
}

event Broker::incoming_connection_established(peer_name: string) {
    print "-> Broker::incoming_connection_established", peer_name;
}
event Broker::incoming_connection_broken(peer_name: string) {
    print "-> Broker::incoming_connection_broken", peer_name;
}

function get_protocol(proto_str: string) : transport_proto {
    # https://www.bro.org/sphinx/scripts/base/init-bare.bro.html#type-transport_proto
    if (proto_str == "tcp") {
        return tcp;
    }
    if (proto_str == "udp") {
        return udp;
    }
    if (proto_str == "icmp") {
        return icmp;
    }
    return unknown_transport;
}

@load ./dio_incident_log.bro
@load ./dio_json_log.bro
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef Broker::endpoint_name = "listener";
global dionaea_connection: event(timestamp: time, id: string, local_ip: addr, local_port: count, remote_ip: addr, remote_port: count, transport: string, connector_id: string);
global dionaea_access(timestamp: time, dst_ip: addr, dst_port: count, src_hostname: string, src_ip: addr, src_port: count, transport: string, protocol: string, connector_id: string);
global get_protocol: function(proto_str: string) : transport_proto;

event bro_init() {
    print "dionaea_receiver.bro: bro_init()";
    Broker::enable();
    Broker::listen(broker_port, "0.0.0.0");
    Broker::subscribe_to_events("honeypot/dionaea/");
    print "dionaea_receiver.bro: bro_init() done";
}
event bro_done() {
    print "dionaea_receiver.bro: bro_done()";
}

event dionaea_connection(timestamp: time, id: string, local_ip: addr, local_port: count, remote_ip: addr, remote_port: count, transport: string, connector_id: string) {
    local lport: port = count_to_port(local_port, get_protocol(transport));
    local rport: port = count_to_port(remote_port, get_protocol(transport));

    print fmt("dionaea_connection: timestamp=%s, id=%s, local_ip=%s, local_port=%s, remote_ip=%s, remote_port=%s, transport=%s, connector_id=%s", timestamp, id, local_ip, local_port, remote_ip, remote_port, transport, connector_id);
    print fmt("converted ports %s %s", lport, rport);
    local rec: Dio_incident::Info = [$ts=timestamp, $id=id, $local_ip=local_ip, $local_port=lport, $remote_ip=remote_ip, $remote_port=rport, $transport=transport, $connector_id=connector_id];

    Log::write(Dio_incident::LOG, rec);
}

event dionaea_access(timestamp: time, dst_ip: addr, dst_port: count, src_hostname: string, src_ip: addr, src_port: count, transport: string, protocol: string, connector_id: string) {
    local sport: port = count_to_port(src_port, get_protocol(transport));
    local dport: port = count_to_port(dst_port, get_protocol(transport));

    print fmt("dionaea_access: timestamp=%s, dst_ip=%s, dst_port=%s, src_hostname=%s, src_ip=%s, src_port=%s, transport=%s, protocol=%s, connector_id=%s", timestamp, dst_ip, dst_port, src_hostname, src_ip, src_port, transport, protocol, connector_id);
    local rec: Dio_access::Info = [$ts=timestamp, $dst_ip=dst_ip, $dst_port=dst_port, $src_hostname=src_hostname, $src_ip=src_ip, $src_port=src_port, $transport=transport, $protocol=protocol, $connector_id=connector_id];

    Log::write(Dio_access::LOG, rec);
}

event Broker::incoming_connection_established(peer_name: string) {
    print "-> Broker::incoming_connection_established", peer_name;
}
event Broker::incoming_connection_broken(peer_name: string) {
    print "-> Broker::incoming_connection_broken", peer_name;
}

function get_protocol(proto_str: string) : transport_proto {
    # https://www.bro.org/sphinx/scripts/base/init-bare.bro.html#type-transport_proto
    if (proto_str == "tcp") {
        return tcp;
    }
    if (proto_str == "udp") {
        return udp;
    }
    if (proto_str == "icmp") {
        return icmp;
    }
    return unknown_transport;
}


Small fixes

Small fixes

Now "@load"-ing the http.bro script within http-identified-files.bro so it actually works.
Small style fixes.

# Copyright 2008 Seth Hall <hall.692@osu.edu>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that: (1) source code distributions
# retain the above copyright notice and this paragraph in its entirety, (2)
# distributions including binary code include the above copyright notice and
# this paragraph in its entirety in the documentation or other materials
# provided with the distribution, and (3) all advertising materials mentioning
# features or use of this software display the following acknowledgement:
# ``This product includes software developed by the University of California,
# Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
# the University nor the names of its contributors may be used to endorse
# or promote products derived from this software without specific prior
# written permission.
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
@load http

module HTTP;

export {
	const http_magic_log = open_log_file("http-identified-files") &raw_output &redef;

	# Base the libmagic analysis on at least this many bytes.
	const magic_content_limit = 1024 &redef;

	const watched_mime_types: set[string] = {
		"application/x-dosexec",      # Windows and DOS executables
		"application/x-executable",   # *NIX executable binary
	} &redef;

	const watched_descriptions =
		/PHP script text/ &redef;

	# URLs included here are not logged and notices are not thrown.
	# Take care when defining regexes to not be overly broad.
	const ignored_urls = /^http:\/\/www\.download\.windowsupdate\.com\// &redef;

	redef enum Notice += {
		# This notice is thrown when the file extension doesn't match the file contents
		HTTP_IncorrectFileType,
	};

	# Create regexes that *should* in be in the urls for specifics mime types.
	# Notices are thrown if the pattern doesn't match the url for the file type.
	const mime_types_extensions: table[string] of pattern = {
		["application/x-dosexec"] = /\.([eE][xX][eE]|[dD][lL][lL])/,
	} &redef;
}

event http_entity_data(c: connection, is_orig: bool, length: count, data: string)
	{
	if ( is_orig ) # We are only watching for server responses
		return;

	local s = lookup_http_request_stream(c);
	local msg = get_http_message(s, is_orig);

@ifndef	( content_truncation_limit )
	# This is only done if http-body.bro is not loaded.
	msg$data_length = msg$data_length + length;
@endif

	# For the time being, we'll just use the data from the first packet.
	# Don't continue until we have enough data
	#if ( msg$data_length < magic_content_limit )
	#	return;

	# Right now, only try this for the first chunk of data
	if ( msg$data_length > length )
		return;

	local abstract = sub_bytes(data, 1, magic_content_limit);
	local magic_mime = identify_data(abstract, T);
	local magic_descr = identify_data(abstract, F);

	if ( (magic_mime in watched_mime_types ||
	      watched_descriptions in magic_descr) &&
	     s$first_pending_request in s$requests )
		{
		local r = s$requests[s$first_pending_request];
		local host = (s$next_request$host=="") ? fmt("%s", c$id$resp_h) : s$next_request$host;
		local url = fmt("http://%s%s", host, r$URI);

		event file_transferred(c, abstract, magic_descr, magic_mime);

		if ( ignored_urls in url )
			return;

		local file_type = "";
		if ( magic_mime in watched_mime_types )
			file_type = magic_mime;
		else
			file_type = magic_descr;

		print http_magic_log, cat_sep("\t", "\\N", network_time(), s$id,
		                                           c$id$orig_h, fmt("%d", c$id$orig_p),
		                                           c$id$resp_h, fmt("%d", c$id$resp_p),
		                                           file_type, r$method, url);

		if ( (magic_mime in mime_types_extensions &&
		      mime_types_extensions[magic_mime] !in url) ||
		     (magic_descr in mime_types_extensions &&
		      mime_types_extensions[magic_descr] !in url) )
			{
			local message = fmt("%s %s %s", file_type, r$method, url);
			NOTICE([$note=HTTP_IncorrectFileType,
			        $msg=message,
			        $conn=c,
			        $method=r$method,
			        $URL=url]);
			}
		}
	}

# Copyright 2008 Seth Hall <hall.692@osu.edu>
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that: (1) source code distributions
# retain the above copyright notice and this paragraph in its entirety, (2)
# distributions including binary code include the above copyright notice and
# this paragraph in its entirety in the documentation or other materials
# provided with the distribution, and (3) all advertising materials mentioning
# features or use of this software display the following acknowledgement:
# ``This product includes software developed by the University of California,
# Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
# the University nor the names of its contributors may be used to endorse
# or promote products derived from this software without specific prior
# written permission.
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

module HTTP;

export {
	const http_magic_log = open_log_file("http-identified-files") &raw_output &redef;

	# Base the libmagic analysis on at least this many bytes.
	const magic_content_limit = 1024 &redef;

	const watched_mime_types: set[string] = {
		"application/x-dosexec",      # Windows and DOS executables
		"application/x-executable",   # *NIX executable binary
	} &redef;

	const watched_descriptions =
		/PHP script text/ &redef;

	# URLs included here are not logged and notices are not thrown.
	# Take care when defining regexes to not be overly broad.
	const ignored_urls = /^http:\/\/www\.download\.windowsupdate\.com\// &redef;

	redef enum Notice += {
		# This notice is thrown when the file extension doesn't match the file contents
		HTTP_IncorrectFileType,
	};

	# Create regexes that *should* in be in the urls for specifics mime types.
	# Notices are thrown if the pattern doesn't match the url for the file type.
	const mime_types_extensions: table[string] of pattern = {
		["application/x-dosexec"] = /\.([eE][xX][eE]|[dD][lL][lL])/,
	} &redef;
}

event http_entity_data(c: connection, is_orig: bool, length: count, data: string)
	{
	if ( is_orig ) # We are only watching for server responses
		return;

	local s = lookup_http_request_stream(c);
	local msg = get_http_message(s, is_orig);

@ifndef	( content_truncation_limit )
	# This is only done if http-body.bro is not loaded.
	msg$data_length = msg$data_length + length;
@endif

	# For the time being, we'll just use the data from the first packet.
	# Don't continue until we have enough data
	#if ( msg$data_length < magic_content_limit )
	#	return;

	# Right now, only try this for the first chunk of data
	if ( msg$data_length > length )
		return;

	local abstract = sub_bytes(data, 1, magic_content_limit);
	local magic_mime = identify_data(abstract, T);
	local magic_descr = identify_data(abstract, F);

	if ( (magic_mime in watched_mime_types ||
	      watched_descriptions in magic_descr) &&
	     s$first_pending_request in s$requests )
		{
		local r = s$requests[s$first_pending_request];
		local host = (s$next_request$host=="") ? fmt("%s", c$id$resp_h) : s$next_request$host;
		local url = fmt("http://%s%s", host, r$URI);

		event file_transferred(c, abstract, magic_descr, magic_mime);

		if ( ignored_urls in url )
			return;

		local file_type: string = "";
		if ( magic_mime in watched_mime_types )
			file_type = magic_mime;
		else
			file_type = magic_descr;

		print http_magic_log, cat_sep("\t", "\\N", network_time(), s$id, c$id$orig_h, fmt("%d", c$id$orig_p), c$id$resp_h, fmt("%d", c$id$resp_p), file_type, r$method, url);

		if ( (magic_mime in mime_types_extensions && mime_types_extensions[magic_mime] !in url) ||
		     (magic_descr in mime_types_extensions && mime_types_extensions[magic_descr] !in url) )
			{
			local message = fmt("%s %s %s", file_type, r$method, url);
			NOTICE([$note=HTTP_IncorrectFileType,
			        $msg=message,
			        $conn=c,
			        $method=r$method,
			        $URL=url]);
			}
		}
	}


Create multiplequerysubscription.bro

Create multiplequerysubscription.bro

module osquery;

const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef osquery::endpoint_name = "Printer";

global added_acpi_tables: event(host: string, name: string, size: count, md5: string);
global removed_acpi_tables: event(host: string, name: string,size: count,md5: string);
###################################################################################
global added_arp_cache: event(host: string, address: string, mac: string, interface: string);
global removed_arp_cache: event(host: string, address: string, mac: string, interface: string);
###################################################################################
global added_block_devices: event(host: string, name: string,vendor: string, model: string);
global removed_block_devices: event(host: string, name: string,vendor: string, model: string);
###################################################################################
global added_chrome_extensions: event(host: string, name: string,author: string, path:string);
global removed_chrome_extensions: event(host: string, name: string,author: string, path:string);
###################################################################################
global added_cpuid: event(host: string, feature: string, value: string);
global removed_cpuid: event(host: string, feature: string, value: string);
###################################################################################
global added_crontab: event(host: string, hour: count, command: string, path: string);
global removed_crontab: event(host: string, hour: count, command: string, path: string);
###################################################################################
global added_disk_encryption: event(host: string, name: string, uuid: string, encrypted: count);
global removed_disk_encryption: event(host: string, name: string, uuid: string, encrypted: count);
###################################################################################
global added_etc_hosts: event(host: string, address: string, hostnames: string);
global removed_etc_hosts: event(host: string, address: string, hostnames: string);
###################################################################################
global added_etc_protocols: event(host: string, name: string, number: count);
global removed_etc_protocols: event(host: string, name: string, number: count);
###################################################################################
global added_etc_services: event(host: string, name: string, prt: count, protocol: string);
global removed_etc_services: event(host: string, name: string, prt: count, protocol: string);
###################################################################################
global added_file_events: event(host: string, target_path: string, action: string, t: count);
global removed_file_events: event(host: string, target_path: string, action: string, t: count);
###################################################################################
global added_firefox_addons: event(host: string, name: string, source_url: string, location: string);
global removed_firefox_addons: event(host: string, name: string, source_url: string, location: string);
###################################################################################
global added_groups: event(host: string, gid: count, groupname: string);
global removed_groups: event(host: string, gid: count, groupname: string);
###################################################################################
global added_hardware_events: event(host: string, action: string, model: string, vendor: string);
global removed_hardware_events: event(host: string, action: string, model: string, vendor: string);
###################################################################################
global added_interface_address: event(host: string, interface: string, address: string);
global removed_interface_address: event(host: string, interface: string, address: string);
###################################################################################
global added_interface_details: event(host: string, interface: string, mac: string, mtu: count);
global removed_interface_details: event(host: string, interface: string, mac: string, mtu: count);
###################################################################################
global added_kernel_info: event(host: string, version: string, path: string, device: string);
global removed_kernel_info: event(host: string, version: string, path: string, device: string);
###################################################################################
global added_last: event(host: string, username: string, pid: count, h: string);
global removed_last: event(host: string, username: string, pid: count, h: string);
###################################################################################
global added_listening_ports: event(host: string, pid: count, prt: count, protocol: count);
global removed_listening_ports: event(host: string, pid: count, prt: count, protocol: count);
###################################################################################
global added_logged_in_users: event(host: string, user: string, h: string, t: count);
global removed_logged_in_users: event(host: string, user: string, h: string, t: count);
###################################################################################
global added_mounts: event(host: string, device: string, path: string);
global removed_mounts: event(host: string, device: string, path: string);
###################################################################################
global added_opera_extensions: event(host: string, name: string, description: string, author: string);
global removed_opera_extensions: event(host: string, name: string, description: string, author: string);
###################################################################################
global added_os_version: event(host: string, name: string, patch: count, build: string);
global removed_os_version: event(host: string, name: string, patch: count, build: string);
###################################################################################
global added_passwd_changes: event(host: string, target_path: string, action: string);
global removed_passwd_changes: event(host: string, target_path: string, action: string);
###################################################################################
global added_pci_devices: event(host: string, pci_slot: string, driver: string, vendor: string, model: string);
global removed_pci_devices: event(host: string, pci_slot: string, driver: string, vendor: string, model: string);
###################################################################################
global added_process_envs: event(host: string, pid: count, key: string, value: string);
global removed_process_envs: event(host: string, pid: count, key: string, value: string);
###################################################################################
global added_process_memory_map: event(host: string, pid: count, permissions: string, device: string);
global removed_process_memory_map: event(host: string, pid: count, permissions: string, device: string);
###################################################################################
global added_process_open_files: event(host: string, pid: count, fd: string, path: string);
global removed_process_open_files: event(host: string, pid: count, fd: string, path: string);
###################################################################################
global added_process_open_sockets: event(host: string, pid: count, socket: count, protocol: count);
global removed_process_open_sockets: event(host: string, pid: count, socket: count, protocol: count);
###################################################################################
global added_processes: event(host: string, pid: count, name: string, path: string, cmdline: string );
global removed_processes: event(host: string, pid: count, name: string, path: string, cmdline : string);
###################################################################################
global added_routes: event(host: string, destination: string, source: string, interface: string);
global removed_routes: event(host: string, destination: string, source: string, interface: string);
###################################################################################
global added_shell_history: event(host: string, username: string, command: string);
global removed_shell_history: event(host: string, username: string, command: string);
###################################################################################
global added_smbios_tables: event(host: string, number: count, description: string, size: count);
global removed_smbios_tables: event(host: string, number: count, description: string, size: count);
###################################################################################
global added_system_controls: event(host: string, name: string, oid: string, subsystem: string);
global removed_system_controls: event(host: string, name: string, oid: string, subsystem: string);
###################################################################################
global added_uptime: event(host: string, days: count, hours: count);
global removed_uptime: event(host: string, days: count, hours: count);
###################################################################################
global added_usb_devices: event(host: string, usb_address: count, vendor: string, model: string);
global removed_usb_devices: event(host: string, usb_address: count, vendor: string, model: string);
###################################################################################
global added_user_groups: event(host: string, uid: count, gid: count);
global removed_user_groups: event(host: string, uid: count, gid: count);
###################################################################################
global added_users: event(host: string, username: string, uid: count, gid: count);
global removed_users: event(host: string, username: string, uid: count, gid: count);
###################################################################################

global query: table[string] of string;
global gconn: table[string] of string;

event bro_init()
{
	osquery::enable();
	osquery::subscribe_to_events("/bro/event/");

	gconn["192.168.1.187"] = "9999";
	gconn["192.168.1.211"] = "9999";
	gconn["192.168.1.33"] = "9999";

	osquery::groupconnect(gconn, 2sec);

	query["osquery::added_acpi_tables"] = "SELECT name,size,md5 FROM acpi_tables";
	#query["osquery::removed_acpi_tables"] = "SELECT name,size,md5 FROM acpi_tables";
	#######################################################################################
	query["osquery::added_arp_cache"] = "SELECT address,mac,interface FROM arp_cache";
	#query["osquery::removed_arp_cache"]= "SELECT address,mac,interface FROM arp_cache";
	#######################################################################################
	#query["osquery::added_block_devices"] =  "SELECT name,vendor,model FROM block_devices";
	#query["osquery::removed_block_devices"] =  "SELECT name,vendor,model FROM block_devices";
	#######################################################################################
	query["osquery::added_chrome_extensions"] =  "SELECT name,author,path FROM chrome_extensions";
	#query["osquery::removed_chrome_extensions"] =  "SELECT name,author,path FROM chrome_extensions";
	########################################################################################
	#query["osquery::added_cpuid"] =  "SELECT feature,value FROM cpuid";
	#query["osquery::removed_cpuid"] =  "SELECT feature,value FROM cpuid";
	#######################################################################################
	#query["osquery::added_crontab"] =  "SELECT event,hour,command FROM crontab";
	#query["osquery::removed_crontab"] =  "SELECT event,hour,command FROM crontab";
	#######################################################################################
	#query["osquery::added_disk_encryption"] =  "SELECT name,uuid,encrypted FROM disk_encryption";
	#query["osquery::removed_disk_encryption"] =  "SELECT name,uuid,encrypted FROM disk_encryption";
	########################################################################################
	#query["osquery::added_etc_hosts"] =  "SELECT address,hostnames FROM etc_hosts";
	#query["osquery::removed_etc_hosts"] =  "SELECT address,hostnames FROM etc_hosts";
	########################################################################################
	#query["osquery::added_etc_protocols"] =  "SELECT name,number FROM etc_protocols";
	#query["osquery::removed_etc_protocols"] =  "SELECT name,number FROM etc_protocols";
	#######################################################################################
	#query["osquery::added_etc_services"] =  "SELECT name,port,protocol FROM etc_services";
	#query["osquery::removed_etc_services"] =  "SELECT name,port,protocol FROM etc_services";
	#######################################################################################
	#query["osquery::added_file_events"] =  "SELECT target_path,action,time FROM file_events";
	#query["osquery::removed_file_events"] =  "SELECT target_path,action,time FROM file_events";
	#######################################################################################
	#query["osquery::added_firefox_addons"] =  "SELECT name,source_url,location FROM firefox_addons";
	#query["osquery::removed_firefox_addons"] =  "SELECT name,source_url,location FROM firefox_addons";
	#######################################################################################
	#query["osquery::added_groups"] =  "SELECT gid,groupname FROM groups";
	#query["osquery::removed_groups"] =  "SELECT gid,groupname FROM groups";
	#######################################################################################
	#query["osquery::added_hardware_events"] =  "SELECT action,model,vendor FROM hardware_events";
	#query["osquery::removed_hardware_events"] =  "SELECT action,model,vendor FROM hardware_events";
	#######################################################################################
	#query["osquery::added_interface_address"] =  "SELECT interface,address FROM interface_address";
	#query["osquery::removed_interface_address"] =  "SELECT interface,address FROM interface_address";
	#######################################################################################
	#query["osquery::added_interface_details"] =  "SELECT interface,mac,mtu FROM interface_details";
	#query["osquery::removed_interface_details"] =  "SELECT interface,mac,mtu FROM interface_details";
	#######################################################################################
	#query["osquery::added_kernel_info"] =  "SELECT version,path,device FROM kernel_info";
	#query["osquery::removed_kernel_info"] =  "SELECT version,path,device FROM kernel_info";
	#######################################################################################
	#query["osquery::added_last"] =  "SELECT username,pid,host FROM last";
	#query["osquery::removed_last"] =  "SELECT username,pid,host FROM last";
	#######################################################################################
	#query["osquery::added_listening_ports"] =  "SELECT pid,port,protocol FROM listening_ports";
	#query["osquery::removed_listening_ports"] =  "SELECT pid,port,protocol FROM listening_ports";
	#######################################################################################
	#query["osquery::added_logged_in_users"] =  "SELECT user,host,time FROM logged_in_users";
	#query["osquery::removed_logged_in_users"] =  "SELECT user,host,time FROM logged_in_users";
	########################################################################################
	#query["osquery::added_mounts"] =  "SELECT device,path FROM mounts";
	#query["osquery::removed_mounts"] =  "SELECT device,path FROM mounts";
	########################################################################################
	#query["osquery::added_opera_extensions"] =  "SELECT name,description,author FROM opera_extensions";
	#query["osquery::removed_opera_extensions"] =  "SELECT name,description,author FROM opera_extensions";
	#######################################################################################
	#query["osquery::added_os_version"] =  "SELECT name,patch,build FROM os_version";
	#query["osquery::removed_os_version"] =  "SELECT name,patch,build FROM os_version";
	#######################################################################################
	#query["osquery::added_passwd_changes"] =  "SELECT target_path,action FROM passwd_changes";
	#query["osquery::removed_passwd_changes"] =  "SELECT target_path,action FROM passwd_changes";
	#######################################################################################
	#query["osquery::added_pci_devices"] =  "SELECT pci_slot,driver,vendor,model FROM pci_devices";
	#query["osquery::removed_pci_devices"] =  "SELECT pci_slot,driver,vendor,model FROM pci_devices";
	#######################################################################################
	#query["osquery::added_process_envs"] =  "SELECT pid,key,value FROM process_envs";
	#query["osquery::removed_process_envs"] =  "SELECT pid,key,value FROM process_envs";
	#######################################################################################
	#query["osquery::added_process_memory_map"] =  "SELECT pid,permissions,device FROM process_memory_map";
	#query["osquery::removed_process_memory_map"] =  "SELECT pid,permissions,device FROM process_memory_map";
	#######################################################################################
	#query["osquery::added_process_open_files"] =  "SELECT pid,fd,path FROM process_open_files";
	#query["osquery::removed_process_open_files"] =  "SELECT pid,fd,path FROM process_open_files";
	#######################################################################################
	#query["osquery::added_process_open_sockets"] =  "SELECT pid,socket,protocol FROM process_open_sockets";
	#query["osquery::removed_process_open_sockets"] =  "SELECT pid,socket,protocol FROM process_open_sockets";
	#######################################################################################
	#query["osquery::added_processes"] =  "SELECT pid,name,path,cmdline FROM processes";
	#query["osquery::removed_processes"] =  "SELECT pid,name,path,cmdline FROM processes";
	#######################################################################################
	#query["osquery::added_routes"] =  "SELECT destination,source,interface FROM routes";
	#query["osquery::removed_routes"] =  "SELECT destination,source,interface FROM routes";
	#######################################################################################
	#query["osquery::added_shell_history"] =  "SELECT username,command FROM shell_history";
	#query["osquery::removed_shell_history"] =  "SELECT username,command FROM shell_history";
	#######################################################################################
	#query["osquery::added_smbios_tables"] =  "SELECT number,description,size FROM smbios_tables";
	#query["osquery::removed_smbios_tables"] =  "SELECT number,description,size FROM smbios_tables";
	#######################################################################################
	#query["osquery::added_system_controls"] =  "SELECT name,oid,subsystem FROM system_controls";
	#query["osquery::removed_system_controls"] =  "SELECT name,oid,subsystem FROM system_controls";
	#######################################################################################
	#query["osquery::added_uptime"] =  "SELECT days,hours FROM uptime";
	#query["osquery::removed_uptime"] =  "SELECT days,hours FROM uptime";
	#######################################################################################
	#query["osquery::added_usb_devices"] =  "SELECT usb_address,vendor,model FROM usb_devices";
	#query["osquery::removed_usb_devices"] =  "SELECT usb_address,vendor,model FROM usb_devices";
	########################################################################################
	#query["osquery::added_user_groups"] =  "SELECT uid,gid FROM user_groups";
	#query["osquery::removed_user_groups"] = "SELECT uid,gid FROM user_groups";
	########################################################################################
	#query["osquery::added_users"] =  "SELECT username,uid,gid FROM users";
	#query["osquery::removed_users"] =  "SELECT username,uid,gid FROM users";
	#######################################################################################
}

event BrokerComm::outgoing_connection_established(peer_address: string, peer_port: port, peer_name: string)
{
	print "BrokerComm::outgoing_connection_establisted", peer_address, peer_port, peer_name;

	osquery::groupsubscribe("/bro/event/host2",query);

}

########################### ACPI TABLES ################################################

event added_acpi_tables(host: string, name: string, size: count, md5: string)
{
	print "New acpi_table Entry";
	print fmt("Host = %s Table_name = %s size = %d md5 = %s",host, name, size, md5);
}
event removed_acpi_tables(host: string, name: string,size: count,md5: string)
{
	print "Deleted acpi_table Entry";
	print fmt("Host = %s Table_name = %s size = %d md5 = %s",host, name, size, md5);
}
############################## ARP CACHE ##############################################
event added_arp_cache(host: string, address: string, mac: string, interface: string)
{
	print "New arp_table Entry";
	print fmt("Host = %s Address = %s mac = %s Interface = %s",host, address, mac, interface);
}
event removed_arp_cache(host: string, address: string, mac: string, interface: string)
{
	print "Deleted arp_table Entry";
	print fmt("Host = %s Address = %s mac = %s Interface = %s",host, address, mac, interface);
}
############################## BLOCK DEVICES ###########################################
event added_block_devices(host: string, name: string,vendor: string, model: string)
{
	print "New block_device Entry";
	print fmt("Host = %s Name = %s Vendor = %s Model = %s",host, name, vendor, model);
}
event removed_block_devices(host: string, name: string,vendor: string, model: string)
{
	print "Deleted block_device Entry";
	print fmt("Host = %s Name = %s Vendor = %s Model = %s",host, name, vendor, model);
}
############################## CHROME EXTENSIONS ##########################################
event added_chrome_extensions(host: string, name: string,author: string, path:string)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s Author = %s Path = %s",host, name, author, path);
}
event removed_chrome_extensions(host: string, name: string,author: string, path:string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s Author = %s Path = %s",host, name, author, path);
}
############################# CPUID #####################################################
event added_cpuid(host: string, feature: string, value: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Feature = %s Value = %s",host, feature,value);
}
event removed_cpuid(host: string, feature: string, value: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Feature = %s Value = %s",host, feature,value);
}
############################ CRONTAB ####################################################
event added_crontab(host: string, hour: count, command: string, path: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Hour = %d Command = %s Path=%s",host, hour, command, path);
}
event removed_crontab(host: string, hour: count, command: string,path: string)
{
	print fmt("Host = %s Hour = %d Command = %s Path=%s",host, hour, command, path);
}
########################### DISK ENCRYPTION ###############################################
event added_disk_encryption(host: string, name: string, uuid: string, encrypted: count)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s uuid = %s encrypted=%d",host, name, uuid, encrypted);
}
event removed_disk_encryption(host: string, name: string, uuid: string, encrypted: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s uuid = %s encrypted=%d",host, name, uuid, encrypted);
}
########################### ETC HOSTS ########################################################
event added_etc_hosts(host: string, address: string, hostnames: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Address = %s hostnames = %s ",host, address, hostnames);
}
event removed_etc_hosts(host: string, address: string, hostnames: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Address = %s hostnames = %s ",host, address, hostnames);
}
########################### ETC PROTOCOLS #################################################
event added_etc_protocols(host: string, name: string, number: count)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s number = %d ",host, name, number);
}
event removed_etc_protocols(host: string, name: string, number: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s number = %d ",host, name, number);
}
########################### ETC SERVICES ##################################################
event added_etc_services(host: string, name: string, prt: count, protocol: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s prt = %d Protocol = %s ",host, name, prt, protocol);
}
event removed_etc_services(host: string, name: string, prt: count, protocol: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s prt = %d Protocol = %s ",host, name, prt, protocol);
}
########################### FILE EVENTS ####################################################
event added_file_events(host: string, target_path: string, action: string, t: count)
{
	print fmt("New entry added");
	print fmt("Host = %s target_path = %s Action = %s Time = %d",host, target_path,action,t);
}
event removed_file_events(host: string, target_path: string, action: string, t: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s target_path = %s Action = %s Time = %d",host, target_path,action,t);
}
############################ FIREFOX ADDONS #################################################
event added_firefox_addons(host: string, name: string, source_url: string, location: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s source_url = %s Locatoin= %s ",host, name, source_url, location);
}
event removed_firefox_addons(host: string, name: string, source_url: string, location: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s source_url = %s Locatoin= %s ",host, name, source_url, location);
}
############################ ADDED GROUPS ###################################################
event added_groups(host: string, gid: count, groupname: string)
{
	print fmt("New entry added");
	print fmt("Host = %s gid = %d groupnumber = %s ",host, gid, groupname);
}
event removed_groups(host: string, gid: count, groupname: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s gid = %d groupnumber = %s ",host, gid, groupname);
}
############################ HARDWARE EVENTS ##################################################
event added_hardware_events(host: string, action: string, model: string, vendor: string)
{
	print fmt("New entry added");
	print fmt("Host = %s action = %s model = %s  Vendor =%s",host, action, model,vendor);
}
event removed_hardware_events(host: string, action: string, model: string, vendor: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s action = %s model = %s  Vendor =%s",host, action, model,vendor);
}
########################### INTERFACE ADDRESS ##################################################
event added_interface_address(host: string, interface: string, address: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Interface = %s Address = %s ",host, interface,address);
}
event removed_interface_address(host: string, interface: string, address: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Interface = %s Address = %s ",host, interface,address);
}
############################ INTERFACE DETAILS ##################################################
event added_interface_details(host: string, interface: string, mac: string, mtu: count)
{
	print fmt("New entry added");
	print fmt("Host = %s interface= %s mac = %s Mtu =%d ",host, interface,mac,mtu);
}
event removed_interface_details(host: string, interface: string, mac: string, mtu: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s interface= %s mac = %s Mtu =%d ",host, interface,mac,mtu);
}
############################ KERNEL INFO ####################################################
event added_kernel_info(host: string, version: string, path: string, device: string)
{
	print fmt("New entry added");
	print fmt("Host = %s version = %s path = %s Device =%s",host, version,path,device);
}
event removed_kernel_info(host: string, version: string, path: string, device: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s version = %s path = %s Device =%s",host, version,path,device);
}
############################# LAST ##########################################################
event added_last(host: string, username: string, pid: count, h: string)
{
	print fmt("New entry added");
	print fmt("Host = %s username = %s pid = %d Host=%s",host, username, pid,h);
}
event removed_last(host: string, username: string, pid: count, h: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s username = %s pid = %d Host=%s",host, username, pid,h);
}
############################# LISTENING PORTS ################################################
event added_listening_ports(host: string, pid: count, prt: count, protocol: count)
{
	print fmt("New entry added");
	print fmt("Host = %s pid = %d prt = %d Protocol =%d ",host, pid,prt,protocol);
}
event removed_listening_ports(host: string, pid: count, prt: count, protocol: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s pid = %d prt = %d Protocol =%d ",host, pid,prt,protocol);
}
############################# LOGGED IN USERS #################################################
event added_logged_in_users(host: string, user: string, h: string, t: count)
{
	print fmt("New entry added");
	print fmt("Host = %s User = %s Host = %s Time =%d ",host, user,h,t);
}
event removed_logged_in_users(host: string, user: string, h: string, t: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s User = %s Host = %s Time =%d ",host, user,h,t);
}
############################ MOUNTS ##########################################################
event added_mounts(host: string, device: string, path: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Device = %s Path = %s ",host, device,path);
}
event removed_mounts(host: string, device: string, path: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Device = %s Path = %s ",host, device,path);
}
############################ OPERA EXTENSIONS #################################################
event added_opera_extensions(host: string, name: string, description: string, author: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s description = %s Author=%s ",host, name,description,author);
}
event removed_opera_extensions(host: string, name: string, description: string, author: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s description = %s Author=%s ",host, name,description,author);
}
############################ OS VERSION ######################################################
event added_os_version(host: string, name: string, patch: count, build: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s Patch = %d Build = %s ",host, name, patch,build);
}
event removed_os_version(host: string, name: string, patch: count, build: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s Patch = %d Build = %s ",host, name, patch,build);
}
############################ PASSWORD CHANGES ##################################################
event added_passwd_changes(host: string, target_path: string, action: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Target_Path = %s Action = %s ",host, target_path,action);
}
event removed_passwd_changes(host: string, target_path: string, action: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Target_Path = %s Action = %s ",host, target_path,action);
}
############################ PCI DEVICES #####################################################
event added_pci_devices(host: string, pci_slot: string, driver: string, vendor: string, model: string)
{
	print fmt("New entry added");
	print fmt("Host = %s PCI_Slot = %s Driver = %s Vendor =%s Model= %s",host, pci_slot,driver,vendor,model);
}
event removed_pci_devices(host: string, pci_slot: string, driver: string, vendor: string, model: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s PCI_Slot = %s Driver = %s Vendor =%s Model= %s",host, pci_slot,driver,vendor,model);
}
########################### PROCESS EVENTS #####################################################
event added_process_envs(host: string, pid: count, key: string, value: string)
{
	print fmt("New entry added");
	print fmt("Host = %s PID = %d Key = %s Value = %s ",host, pid,key,value);
}
event removed_process_envs(host: string, pid: count, key: string, value: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s PID = %d Key = %s Value = %s ",host, pid,key,value);
}
########################### PROCESS MOMORY ######################################################
event added_process_memory_map(host: string, pid: count, permissions: string, device: string)
{
	print fmt("New entry added");
	print fmt("Host = %s PID = %d Permissions = %s Device = %s ",host, pid,permissions,device);
}
event removed_process_memory_map(host: string, pid: count, permissions: string, device: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s PID = %d Permissions = %s Device = %s ",host, pid,permissions,device);
}
########################## PROCESS OPEN FILES ###################################################
event added_process_open_files(host: string, pid: count, fd: string, path: string)
{
	print fmt("New entry added");
	print fmt("Host = %s PID = %d FD = %s Path = %s",host, pid,fd,path);
}
event removed_process_open_files(host: string, pid: count, fd: string, path: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s PID = %d FD = %s Path = %s",host, pid,fd,path);
}
########################## PROCESS OPEN SOCKETS ####################################################
event added_process_open_sockets(host: string, pid: count, socket: count, protocol: count)
{
	print fmt("New entry added");
	print fmt("Host = %s PID = %d Socket = %d Protocol =%d",host, pid,socket,protocol);
}
event removed_process_open_sockets(host: string, pid: count, socket: count, protocol: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s PID = %d Socket = %d Protocol =%d",host, pid,socket,protocol);
}
########################## PROCESSES #########################################################
event added_processes(host: string, pid: count, name: string, path: string, cmdline: string)
{
	print fmt("New entry added");
	print fmt("Host = %s PID = %d Name = %s Path = %s cmdline = %s",host, pid,name,path,cmdline);
}
event removed_processes(host: string, pid: count, name: string, path: string, cmdline: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s PID = %d Name = %s Path = %s cmdline = %s",host, pid,name,path,cmdline);
}
########################### ROUTES ########################################################
event added_routes(host: string, destination: string, source: string, interface: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Destination = %s Source = %s Interface = %s ",host, destination,source,interface);
}
event removed_routes(host: string, destination: string, source: string, interface: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Destination = %s Source = %s Interface = %s ",host, destination,source,interface);
}
########################### SHELL HISTORY ####################################################
event added_shell_history(host: string, username: string, command: string)
{
	print fmt("New entry added");
	print fmt("Host = %s UserNmae = %s Command = %s ",host, username, command);
}
event removed_shell_history(host: string, username: string, command: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s UserNmae = %s Command = %s ",host, username, command);
}
############################ SMBIOS TABLES ###################################################
event added_smbios_tables(host: string, number: count, description: string, size: count)
{
	print fmt("New entry added");
	print fmt("Host = %s Number = %d Description = %s Size=%d ",host, number, description,size);
}
event removed_smbios_tables(host: string, number: count, description: string, size: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Number = %d Description = %s Size=%d ",host, number, description,size);
}
############################# SYSTEM CONTROLS ###################################################
event added_system_controls(host: string, name: string, oid: string, subsystem: string)
{
	print fmt("New entry added");
	print fmt("Host = %s Name = %s OID = %s Subsystem =%s ",host, name, oid, subsystem);
}
event removed_system_controls(host: string, name: string, oid: string, subsystem: string)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Name = %s OID = %s Subsystem =%s ",host, name, oid, subsystem);
}
############################## UPTIME ###################################################
event added_uptime(host: string, days: count, hours: count)
{
	print fmt("New entry added");
	print fmt("Host = %s Days = %d Hours = %d ",host, days,hours);
}
event removed_uptime(host: string, days: count, hours: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s Days = %d Hours = %d ",host, days,hours);
}
############################# USB DEVICES ###################################################
event added_usb_devices(host: string, usb_address: count, vendor: string, model: string)
{
	print "New Usb Device Added";
 	print fmt("Host = %s Usb_address = %d Vendor = %s Model = %s",host, usb_address, vendor, model);
}
event removed_usb_devices(host: string, usb_address: count, vendor: string, model: string)
{
	print "Usb Device Removed";
 	print fmt("Host = %s Usb_address = %d Vendor = %s Model = %s",host, usb_address, vendor, model);
}
############################# USER GROUPS ###################################################
event added_user_groups(host: string, uid: count, gid: count)
{
	print fmt("New entry added");
	print fmt("Host = %s UID = %d GID = %d ",host, uid, gid);
}
event removed_user_groups(host: string, uid: count, gid: count)
{
	print fmt("Entry Removed");
	print fmt("Host = %s UID = %d GID = %d ",host, uid, gid);
}
############################# USERS ######################################################
event added_users(host: string, username: string, uid: count, gid: count)
{
	print "New User Added";
 	print fmt("Host = %s UserName = %s UID = %d GID = %d",host, username, uid, gid);
}
event removed_users(host: string, username: string, uid: count, gid: count)
{
	print "User Removed";
 	print fmt("Host = %s UserName = %s UID = %d GID = %d",host, username, uid, gid);
}

error: pathspec 'multiplequerysubscription.bro' did not match any file(s) known to git


add cx.cc to regex

add cx.cc to regex

@load http-ext
@load ipblocker

module HTTP;

export {
    redef enum Notice += {
        HTTP_IncorrectFileTypeBadHost
    };

    const bad_exec_domains =
        /co\.cc/
      | /cx\.cc/
      | /cz\.cc/
        &redef;

    const bad_exec_urls =
        /php.adv=/
      | /http:\/\/[0-9]{1,3}\.[0-9]{1,3}.*\/index\.php\?[^=]+=[^=]+$/ #try to match http://1.2.3.4/index.php?foo=bar
        &redef;

    const bad_user_agents =
        /Java\/1/
        &redef;

}

redef notice_action_filters += {
    [HTTP_IncorrectFileTypeBadHost] = notice_exec_ipblocker_dest,
};

event http_ext(id: conn_id, si: http_ext_session_info) &priority=1
{
    if(is_local_addr(id$resp_h))
        return;
    if(! ("identified-files" in si$tags && si$mime_type == "application/x-dosexec"))
        return;

    if( (bad_exec_domains in si$host || bad_exec_urls in si$url)
      ||(/\.exe/ !in si$url && bad_user_agents in si$user_agent)) {
        NOTICE([$note=HTTP_IncorrectFileTypeBadHost,
                $id=id,
                $msg=fmt("EXE Downloaded from bad host %s %s %s", id$orig_h, id$resp_h, si$url),
                $sub="http-ext"
            ]);
        }
}

@load http-ext
@load ipblocker

module HTTP;

export {
    redef enum Notice += {
        HTTP_IncorrectFileTypeBadHost
    };

    const bad_exec_domains =
        /co\.cc/
      | /cz\.cc/
        &redef;

    const bad_exec_urls =
        /php.adv=/
      | /http:\/\/[0-9]{1,3}\.[0-9]{1,3}.*\/index\.php\?[^=]+=[^=]+$/ #try to match http://1.2.3.4/index.php?foo=bar
        &redef;

    const bad_user_agents =
        /Java\/1/
        &redef;

}

redef notice_action_filters += {
    [HTTP_IncorrectFileTypeBadHost] = notice_exec_ipblocker_dest,
};

event http_ext(id: conn_id, si: http_ext_session_info) &priority=1
{
    if(is_local_addr(id$resp_h))
        return;
    if(! ("identified-files" in si$tags && si$mime_type == "application/x-dosexec"))
        return;

    if( (bad_exec_domains in si$host || bad_exec_urls in si$url)
      ||(/\.exe/ !in si$url && bad_user_agents in si$user_agent)) {
        NOTICE([$note=HTTP_IncorrectFileTypeBadHost,
                $id=id,
                $msg=fmt("EXE Downloaded from bad host %s %s %s", id$orig_h, id$resp_h, si$url),
                $sub="http-ext"
            ]);
        }
}


don't keep track of connections at all

don't keep track of connections at all

don't even bother keeping track of connections, just count status codes

# For this script to work, you must define a local_mail table
# listing all of your known mail sending hosts.
# i.e.  const local_mail: set[subnet] = { 1.2.3.4/32 };

@ifdef ( local_mail )

@load conn-id
@load smtp

module SMTP;

type smtp_counter: record {
 rejects: count;
 total: count;
};

export {
 # The idea for this is that if a host makes more than spam_threshold
 # smtp connections per hour of which at least spam_percent of those are
 # rejected and the host is not a known mail sending host, then it's likely
 # sending spam or viruses.
 #
 const spam_threshold = 300 &redef;
 const spam_percent = 30 &redef;

 # These are smtp status codes that are considered "rejected".
 const smtp_reject_codes: set[count] = {
   501, # Bad sender address syntax
   550, # Requested action not taken: mailbox unavailable
   551, # User not local; please try <forward-path>
   553, # Requested action not taken: mailbox name not allowed
   554, # Transaction failed
 };

 redef enum Notice += {
   SMTP_PossibleSpam, # Host sending mail *to* internal hosts is suspicious
   SMTP_PossibleInternalSpam, # Internal host seems to be spamming
   SMTP_StrangeRejectBehavior, # Local mail server is getting high numbers of rejects
 };

 global smtp_status_comparison: table[addr] of smtp_counter &create_expire=1hr &redef;
}

event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
		             msg: string, cont_resp: bool)
{
 if ( c$id$orig_h !in smtp_status_comparison )
 {
   smtp_status_comparison[c$id$orig_h] = [$rejects=0, $total=0];
 }

 # Set the smtp_counter to the local var "foo"
 local foo = smtp_status_comparison[c$id$orig_h];

 if ( code in smtp_reject_codes)
   ++foo$rejects;

 ++foo$total;

 local host = c$id$orig_h;
 if ( foo$total >= spam_threshold ) {
   local percent = (foo$rejects*100) / foo$total;
   if ( percent >= spam_percent ) {
     if ( host in local_mail )
       NOTICE([$note=SMTP_StrangeRejectBehavior, $msg=fmt("a high percentage of mail from %s is being rejected", host), $sub=fmt("sent: %d rejected: %d percent", foo$total, percent), $conn=c]);
     else if ( is_local_addr(host) )
       NOTICE([$note=SMTP_PossibleInternalSpam, $msg=fmt("%s appears to be spamming", host), $sub=fmt("sent: %d rejected: %d percent", foo$total, percent), $conn=c]);
     else
       NOTICE([$note=SMTP_PossibleSpam, $msg=fmt("%s appears to be spamming", host), $sub=fmt("sent: %d rejected: %d percent", foo$total, percent), $conn=c]);
   }
 }
}

@endif

# For this script to work, you must define a local_mail table
# listing all of your known mail sending hosts.
# i.e.  const local_mail: set[subnet] = { 1.2.3.4/32 };

@ifdef ( local_mail )

@load conn-id
@load smtp

module SMTP;

type smtp_counter: record {
 rejects: count;
 total: count;
 connects: set[conn_id];
 rej_conns: set[conn_id];
};

export {
 # The idea for this is that if a host makes more than spam_threshold
 # smtp connections per hour of which at least spam_percent of those are
 # rejected and the host is not a known mail sending host, then it's likely
 # sending spam or viruses.
 #
 const spam_threshold = 300 &redef;
 const spam_percent = 30 &redef;

 # These are smtp status codes that are considered "rejected".
 const smtp_reject_codes: set[count] = {
   501, # Bad sender address syntax
   550, # Requested action not taken: mailbox unavailable
   551, # User not local; please try <forward-path>
   553, # Requested action not taken: mailbox name not allowed
   554, # Transaction failed
 };

 redef enum Notice += {
   SMTP_PossibleSpam, # Host sending mail *to* internal hosts is suspicious
   SMTP_PossibleInternalSpam, # Internal host seems to be spamming
   SMTP_StrangeRejectBehavior, # Local mail server is getting high numbers of rejects
 };

 global smtp_status_comparison: table[addr] of smtp_counter &create_expire=1hr &redef;
}

event smtp_reply(c: connection, is_orig: bool, code: count, cmd: string,
		             msg: string, cont_resp: bool)
{
 if ( c$id$orig_h !in smtp_status_comparison )
 {
   local bar: set[conn_id] &create_expire=1m;
   local blarg: set[conn_id] &create_expire=1m;
   smtp_status_comparison[c$id$orig_h] = [$rejects=0, $total=0, $connects=bar, $rej_conns=blarg];
 }

 # Set the smtp_counter to the local var "foo"
 local foo = smtp_status_comparison[c$id$orig_h];

 if ( code in smtp_reject_codes &&
           c$id !in foo$rej_conns )
 {
   ++foo$rejects;
   local session = smtp_sessions[c$id];
   add foo$rej_conns[c$id];
 }

 if ( c$id !in foo$connects )
 {
   ++foo$total;
   add foo$connects[c$id];
 }

 local host = c$id$orig_h;
 if ( foo$total >= spam_threshold ) {
   local percent = (foo$rejects*100) / foo$total;
   if ( percent >= spam_percent ) {
     if ( host in local_mail )
       NOTICE([$note=SMTP_StrangeRejectBehavior, $msg=fmt("a high percentage of mail from %s is being rejected", host), $sub=fmt("sent: %d rejected: %d percent", foo$total, percent), $conn=c]);
     else if ( is_local_addr(host) )
       NOTICE([$note=SMTP_PossibleInternalSpam, $msg=fmt("%s appears to be spamming", host), $sub=fmt("sent: %d rejected: %d percent", foo$total, percent), $conn=c]);
     else
       NOTICE([$note=SMTP_PossibleSpam, $msg=fmt("%s appears to be spamming", host), $sub=fmt("sent: %d rejected: %d percent", foo$total, percent), $conn=c]);
   }
 }
}

@endif