{"id":19260512,"url":"https://github.com/mitre/icap","last_synced_at":"2025-09-10T23:33:24.277Z","repository":{"id":146198683,"uuid":"242019422","full_name":"mitre/icap","owner":"mitre","description":"Internet Content Adaptation Protocol (ICAP) Analyzer for Bro and Zeek.","archived":false,"fork":false,"pushed_at":"2020-02-21T01:02:16.000Z","size":36,"stargazers_count":10,"open_issues_count":0,"forks_count":2,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-04-01T14:37:37.657Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mitre.png","metadata":{"files":{"readme":"README","changelog":"CHANGES","contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-02-21T00:20:24.000Z","updated_at":"2023-07-12T01:50:45.000Z","dependencies_parsed_at":null,"dependency_job_id":"1093767d-eee1-47fb-9f49-e67a1dc99e38","html_url":"https://github.com/mitre/icap","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Ficap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Ficap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Ficap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Ficap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mitre","download_url":"https://codeload.github.com/mitre/icap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250090953,"owners_count":21373287,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T19:21:25.957Z","updated_at":"2025-04-21T16:31:55.723Z","avatar_url":"https://github.com/mitre.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"===============================\nICAP Analyzer for Bro and Zeek\n===============================\n\nCopyright 2016 The MITRE Corporation.  All rights reserved.\nApproved for public release.  Distribution unlimited.  Case number 16-3871.\n\n==================\nIntroduction\n==================\nInternet Content Adaptation Protocol (ICAP) Analyzer for the Bro and Zeek \nNetwork Security Monitor.\n\nThe ICAP Analyzer was developed on a Bro v2.4.1 platform with BinPAC \nv0.44, using the BinPAC Quick Start guide, and compiled directly into\nthe Bro core.  Recommended for use with Bro v2.4.1 or later.\n\nThe ICAP Analyzer Plugin was developed on a Bro v2.5-draft platform.\nThe Plugin is NOT recommended for Bro v2.4.1 or earlier.  Requires\nBro v2.5 or later.\n\nFor more information about the ICAP analyzer, see the BroCon'16 abstract \nand presentation slides posted on the Bro website, at the following URL:\n  - https://www.bro.org/community/brocon2016.html\n\nFor more information about the ICAP protocol itself, see RFC 3507, dated \nApril 2003, along with the additional references listed below:\n  - https://tools.ietf.org/html/rfc3507\n  - https://tools.ietf.org/html/draft-stecher-icap-subid-00\n  - https://www.icap-forum.org/documents/specifications/\n    draft-icap-ext-partial-content-07.txt\n\nFor more information on Bro Packages and Bro Plugins, see the following \nreferences:\n  - https://github.com/bro/package-manager\n  - https://www.bro.org/sphinx/devel/plugins.html\n\n\n==============================\nInstallation - \nPlugin via Package Manager *\n==============================\n\nTo install the ICAP Analyzer as a Plugin, use the Bro Package Manager to\ninstall the ICAP Analyzer Plugin on Bro v2.5 or later.\n\nFor more information on how to install Bro Packages, see the following\nreference:\n  - https://github.com/bro/package-manager\n\n\n  * NOTE 1: Requires Bro v2.5 or later.\n    NOTE 2: On Bro v2.4.1, the Plugin encounters a discrepancy within\n    Bro's built-in regular-expression pattern-matching functionality,\n    and the ICAP packets parse incorrectly.  This behavior is observed\n    on v2.4.1 only when the ICAP Analyzer is implemented as a Plugin.\n    This behavior is not observed on v2.4.1 when the ICAP Analyzer is\n    compiled directly into the Bro core.  This issue appears to be\n    fixed on v2.5-beta.\n\n\n==============================\nInstallation - \nPlugin via Manual Method *\n==============================\n\nTo install the ICAP Analyzer as a Plugin manually, see the Bro Plugin\ndocumentation at the following URL:\n  - https://www.bro.org/sphinx/devel/plugins.html\n\n\n  * NOTE 1: Requires Bro v2.5 or later.\n    NOTE 2: On Bro v2.4.1, the Plugin encounters a discrepancy within\n    Bro's built-in regular-expression pattern-matching functionality,\n    and the ICAP packets parse incorrectly.  This behavior is observed\n    on v2.4.1 only when the ICAP Analyzer is implemented as a Plugin.\n    This behavior is not observed on v2.4.1 when the ICAP Analyzer is\n    compiled directly into the Bro core.  This issue appears to be\n    fixed on v2.5-beta.\n\n\n==============================\nInstallation - \nCompile into Bro Core\n==============================\n\nTo compile the ICAP Analyzer directly into the Bro core, follow Steps 1 \nthru 8 below.  Recommended for use with Bro v2.4.1 or later.\n\nThe expression \u003cbro_distro\u003e denotes the path of the Bro distribution, \nsuch as /opt/bro-2.4.1.\n\nThe expression \u003cbro_install\u003e denotes the installation path after running\n'make install' on the source code, such as /usr/local/bro.\n\n\n--------------\nStep 1 - Root.\n--------------\n1.1 Change to the root account.\n\n1.2 Proceed to Step 2.\n\n\n------------------------------------------------\nStep 2 - Copy Source Files into Bro Source Tree.\n------------------------------------------------\n2.1 Create ICAP directories in the Bro source tree:\n    mkdir \u003cbro_distro\u003e/src/analyzer/protocol/icap\n    mkdir \u003cbro_distro\u003e/scripts/base/protocols/icap\n\n2.2 Copy the following ICAP files into the Bro src directory \u003cbro_distro\u003e/src/analyzer/protocol/icap:\n    ./CHANGES\n    ./COPYING\n    ./README\n    ./VERSION\n    ./src/CMakeLists.txt*\n    ./src/ICAP.cc\n    ./src/ICAP.h\n    ./src/Plugin.cc\n    ./src/events.bif\n    ./src/icap.pac\n    ./src/icap-analyzer.pac\n    ./src/icap-analyzer-http.pac\n    ./src/icap-analyzer-utils.pac\n    ./src/icap-protocol.pac\n\n  * NOTE: This file './src/CMakeLists.txt' is used for compiling the\n    ICAP Analyzer into the Bro Core.  The other file './CMakeLists.txt'\n    is used for building is as a Plugin.\n \n2.3 Copy the following ICAP files into the Bro scripts directory \u003cbro_distro\u003e/scripts/base/protocols/icap:\n    ./scripts/__load__.bro\n    ./scripts/dpd.bro\n    ./scripts/main.bro\n\n2.4 Proceed to Step 3.\n\n\n-----------------------------\nStep 3 - Edit Bro Build List.\n-----------------------------\n3.1 Edit the Bro file \u003cbro_distro\u003esrc/analyzer/protocol/CMakelists.txt*\n    to add the following statement (in alphabetical order, between http\n    and icmp):\n    add_subdirectory(icap)\n\n  * NOTE: This is NOT the same file copied onto Bro in Step 2.2.\n    This file has the same name, but it is already on the system, \n    one directory up.\n\n3.2 Save changes.\n\n3.3 Proceed to Step 4.\n\n\n-------------------------------\nStep 4 - Edit Bro Startup List.\n-------------------------------\n4.1 Edit the Bro file \u003cbro_distro\u003e/scripts/base/init-default.bro \n    to add the following statement (in alphabetical order, between http\n    and irc):\n    @load base/protocols/icap\n\n4.2 Save changes.\n\n4.3 Proceed to Step 5.\n\n\n------------------------------------------------\nStep 5 - Add Custom Scripts to Bro Startup List.\n------------------------------------------------\n5.1 [Optional] Edit the Bro file \u003cbro_install\u003e/share/bro/site/local.bro\n    to load any custom Bro scripts related to ICAP analysis.\n\n5.2 [Optional] Save changes.\n\n5.3 Proceed to Step 6.\n\n\n---------------------\nStep 6 - Re-Make Bro.\n---------------------\n6.1 If Bro is already running, stop Bro, via the following command:\n    \u003cbro_install\u003e/bin/broctl stop\n\n6.2 Configure, make \u0026 install Bro:\n    cd \u003cbro_distro\u003e\n    ./configure  (NOTE: include any flags/options, if applicable)\n    make\n    make install\n\n6.3 [Optional] If using PF_RING, confirm Bro is linked with PF_RING \n    libpcap:\n    ldd \u003cbro_install\u003e/bin/bro | grep pcap\n\n6.4 Proceed to Step 7.\n\n\n-------------------------------------\nStep 7 - Re-Start Bro via BroControl.\n-------------------------------------\n7.1 Start Bro:\n    \u003cbro_install\u003e/bin/broctl deploy\n\n7.2 Confirm Bro is running:\n    \u003cbro_install\u003e/bin/broctl status\n\n7.3 Confirm ICAP Analyzer is active:\n    \u003cbro_install\u003e/bin/bro -N | grep ICAP\n\n7.4 Proceed to Step 8.\n\n\n--------------\nStep 8 - Done.\n--------------\n8.1  Installation complete.  No further action required.\n\n\n#end README\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Ficap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmitre%2Ficap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Ficap/lists"}