Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/jandre/brosquery
module for osquery to load Bro logs into tables
https://github.com/jandre/brosquery
Last synced: 2 months ago
JSON representation
module for osquery to load Bro logs into tables
- Host: GitHub
- URL: https://github.com/jandre/brosquery
- Owner: jandre
- License: mit
- Created: 2015-04-27T00:08:27.000Z (about 9 years ago)
- Default Branch: master
- Last Pushed: 2015-04-28T14:19:57.000Z (about 9 years ago)
- Last Synced: 2024-04-14T15:09:07.551Z (3 months ago)
- Language: C++
- Homepage:
- Size: 531 KB
- Stars: 27
- Watchers: 6
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Lists
- awesome-threat-detection - Brosquery - A module for osquery to load Bro logs into tables (Tools)
- Awesome-Threat-Detection - Brosquery - A module for osquery to load Bro logs into tables (Threat Detection and Hunting / Tools)
- repo-2396-awesome-threat-detection - Brosquery - A module for osquery to load Bro logs into tables (Threat Detection and Hunting / Tools)
- repo-2430-awesome-threat-detection - Brosquery - A module for osquery to load Bro logs into tables (Threat Detection and Hunting / Tools)
README
## What?
This project builds an OSQuery module `libbro.so` for loading `bro` logs as tables in osquery.
The logs are *dynamically* loaded into tables from the `bro` logs installation directory. They are created as tables based on their
log file name, except pre-pended with `bro_`. E.g., `conn.log` -> table `bro_conn`.
## Example
From [EnvDB](https://github.com/mephux/envdb) UI:
## Building and Installing
To build, you need `cmake`, `clang`, `git` (for both osquery and module builds).
```bash
make deps
make
```
This will create the module `./build/src/libbro.`
You will then need to copy this to `/usr/local/lib/libbro.` and then you can add an entry to `/etc/osquery/modules.load`:
```bash
$ sudo cp -r ./build/src/libbro. /usr/local/lib
$ sudo mkdir -p /etc/osquery/
$ sudo sh -c 'echo "/usr/local/lib/libbro." >> /etc/osquery/modules.load'
```
You can now run `osqueryi` with the location of `$BROLOGS` set to the bro logs path, where it will attempt to load log tables from `$BROLOGS`.
Example:
```bash
sudo BROLOGS="$PWD/bro/logs" osqueryi
```
Without BROLOGS set, it will try to load logs from the following common Bro installation locations:
```
/usr/local/bro/logs/current
/opt/bro/logs
/nsm/bro/logs/current
```
### Installing for EnvDB
To get it to work with EnvDB, you need to create a wrapper script for `osqueryi` that supplies the correct environment variable
for the `BROPATH`. This should be in your path *before* osqueryi.
E.g., add this to your path:
```
root@vagrant-ubuntu-trusty-64:~# more /usr/bin/osqueryi
#!/bin/sh
BROLOGS="/path/to/bro/logs" /path/to/real/osqueryi "$@"
```
You can also try setting BROLOGS=xxx in EnvDB startup although I'm not certain that works.
## TODO
* [X] Better Bro log path detection.
* [X] Add variable `BROLOGS` to specify where the bro logs are, or maybe a more flexible way to supply this to osquery.
* [ ] Better type handling? Better error handling?
General wishlist: I wish osquery had a nicer way of loading any log dynamically into its framework. :)