https://github.com/hashtagcyber/bropy

Basic Anomaly IDS capabilities with Python and Bro
https://github.com/hashtagcyber/bropy

Last synced: 3 months ago
JSON representation

Basic Anomaly IDS capabilities with Python and Bro

• Host: GitHub
• URL: https://github.com/hashtagcyber/bropy
• Owner: hashtagcyber
• License: mit
• Archived: true
• Created: 2017-03-13T13:53:02.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2018-02-27T16:11:20.000Z (over 6 years ago)
• Last Synced: 2024-05-31T09:34:13.446Z (5 months ago)
• Language: Python
• Homepage:
• Size: 7.8 MB
• Stars: 105
• Watchers: 10
• Forks: 15
• Open Issues: 7
• Metadata Files:
  • Readme: README.md
  • License: LICENSE
  • Security: SecurityOnionCon-ArmingSmallSecurityPrograms-Bropy.pptx

Awesome Lists containing this project

• awesome-hacking-lists - hashtagcyber/bropy - Basic Anomaly IDS capabilities with Python and Bro (Python)

README

        
# bropy

Basic Anomaly IDS capabilities with Python and Bro

Awesome quality video of me doing a terrible job talking about Bropy... https://www.youtube.com/watch?v=hz2eAWV54i0

CHANGELOG

-Bropy can now generate a list for each host it detects (usefull for handing out to sysadmins to Q/C entries)

-Bropy can now parse conn.logs directly to generate a list of all services. Check out the "advanced" option

-Now using bropy.cfg to set directory parameters.

	(Default setting is for SecurityOnion, if you did a custom install, you'll need to edit bropy/etc/bropy.cfg)

-Now using modules to do log processing and rule generatin.o

	(modules/bropy_logs.py,modules/bropy_rules.py)

-Rules are now sorted by IP Destination (Kinda, 21 comes after 100)

-"Auto baseline" is now in the advanced menu... Don't do it.

TODO

-Move more stuff to modules to make bropy.py cleaner

-Allow for custom subnets when generating rules (may need to import another module for subnet testing)

-Allow for comments at Y/N time (i.e. "MYSQL port for dbsvr")

-Generate lists using NETFLOW data (this is gonna take some work)

- IPv6 to make my Troopers friends happy! (Ok, well, me too, IPv6 support would be awesome)