hosom / bro-otx Goto Github PK
View Code? Open in Web Editor NEWIntegrate Zeek with Alienvault OTX
License: BSD 3-Clause "New" or "Revised" License
Integrate Zeek with Alienvault OTX
License: BSD 3-Clause "New" or "Revised" License
Hello,
I have installed BRO-OTX as suggested but there is no intel.log file and also in /usr/local/bro/logs/current/loaded_scripts.log there is no record of otx, Am I doing something wrong?
I have installed bro-otx into /usr/local/bro/share/bro/policy/bro-otx and in load.bro I have @load bro-otx
I have ran /usr/local/bro/bin/broctl check and get no errors about otx (and when I make the path wrong it gives me an error).
Im sure its simple, if you can point me in the right direction that would be great!
Daniel
Would it be possible to include more info about the OTX pulse in the Sources field?
Currently when using this Bro script when I have an intel hit from OTX it only lists (what I think) is the OTX username that the indicator came from in the Sources field.
I was previously using the AlienVault Bro IDS Connector (https://github.com/AlienVault-Labs/OTX-Apps-Bro-IDS) but switched to this as it seemed like a better implementation. Using the AlienVault Bro IDS Connector the source in Bro's intel log was listed as "AlienVault OTX - [Pulse name] - [Pulse id]"
Need to make the configuration file location configurable by the user
In OTX, URLs are listed including the protocol scheme (http://
ftp://
etc). The Intel::URL
indicator type (seen.indicator_type) in bro-otx fails to trigger if the scheme exists.
Example: if otx.dat
has an Intel::URL
entry "http://example.com/path.txt" Bro will not react. However, if the otx.dat
entry is simply "example.com/path.txt", Bro triggers as expected.
Is it possible for bro-otx to strip the protocol scheme from Intel::URL
types?
0.000000 Reporter::ERROR /opt/bro/share/bro/site/otx/otx.dat/Input::READER_ASCII: could not read first line (empty)
Seems to be caused by writing the file in place. Should be an easy fix to write it under a temporary name and then move it to the proper name.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.