hosom / bro-otx Goto Github PK

Hello,

I have installed BRO-OTX as suggested but there is no intel.log file and also in /usr/local/bro/logs/current/loaded_scripts.log there is no record of otx, Am I doing something wrong?

I have installed bro-otx into /usr/local/bro/share/bro/policy/bro-otx and in load.bro I have @load bro-otx

I have ran /usr/local/bro/bin/broctl check and get no errors about otx (and when I make the path wrong it gives me an error).

Im sure its simple, if you can point me in the right direction that would be great!

Daniel

Would it be possible to include more info about the OTX pulse in the Sources field?

Currently when using this Bro script when I have an intel hit from OTX it only lists (what I think) is the OTX username that the indicator came from in the Sources field.

I was previously using the AlienVault Bro IDS Connector (https://github.com/AlienVault-Labs/OTX-Apps-Bro-IDS) but switched to this as it seemed like a better implementation. Using the AlienVault Bro IDS Connector the source in Bro's intel log was listed as "AlienVault OTX - [Pulse name] - [Pulse id]"

Need to make the configuration file location configurable by the user

In OTX, URLs are listed including the protocol scheme (http:// ftp:// etc). The Intel::URL indicator type (seen.indicator_type) in bro-otx fails to trigger if the scheme exists.

Example: if otx.dat has an Intel::URL entry "http://example.com/path.txt" Bro will not react. However, if the otx.dat entry is simply "example.com/path.txt", Bro triggers as expected.

Is it possible for bro-otx to strip the protocol scheme from Intel::URL types?

 0.000000        Reporter::ERROR /opt/bro/share/bro/site/otx/otx.dat/Input::READER_ASCII: could not read first line   (empty)

Seems to be caused by writing the file in place. Should be an easy fix to write it under a temporary name and then move it to the proper name.