A Bro Script Case Study Bro Workshop 2011 NCSA, Urbana-Champaign, - - PowerPoint PPT Presentation

a bro script case study
SMART_READER_LITE
LIVE PREVIEW

A Bro Script Case Study Bro Workshop 2011 NCSA, Urbana-Champaign, - - PowerPoint PPT Presentation

A Bro Script Case Study Bro Workshop 2011 NCSA, Urbana-Champaign, IL Bro Workshop 2011 No deep detail now, just enough to understand basic constructs. Important to focus on script structure and data flow. Bro Workshop 2011 2 Script


slide-1
SLIDE 1

Bro Workshop 2011

Bro Workshop 2011 NCSA, Urbana-Champaign, IL

A Bro Script Case Study

slide-2
SLIDE 2

Bro Workshop 2011

  • No deep detail now, just enough to understand

basic constructs.

  • Important to focus on script structure and data

flow.

2

slide-3
SLIDE 3

Bro Workshop 2011

3

Script layout changes in 2.0

slide-4
SLIDE 4

Bro Workshop 2011

Important script directories. Found at: <prefix>/share/bro/

4

slide-5
SLIDE 5

Bro Workshop 2011

base/ directory

  • Everything is loaded by default.
  • Possible to disable with a Bro command line argument, but not

recommended.

  • The scripts are only meant to enable analyzers,

collect state, generate protocol logs, and provide reusable frameworks and function libraries.

  • base/ is not in the default $BROPATH!

5

slide-6
SLIDE 6

Bro Workshop 2011

policy/ directory

  • Nothing here is loaded by default.
  • This is where many of the detections that Bro

does out of the box take place.

  • Almost any functionality that doesnʼt fit into base/

goes here.

6

slide-7
SLIDE 7

Bro Workshop 2011

site/ directory

  • This is where local configuration goes.
  • Files are not overwritten during installation.
  • We include a “suggested” configuration in site/

local.bro

  • Itʼs mostly just a long list of @load statements.

7

slide-8
SLIDE 8

Bro Workshop 2011

SSL Base Scripts

8

slide-9
SLIDE 9

Bro Workshop 2011

  • __load__.bro is an auto

load file. We can now load directories.

  • main.bro is a convention

we use for consistency. There is no special language support for it.

__load__.bro

Quick aside about module layout

Found at: <prefix>/share/bro/base/protocols/

9

slide-10
SLIDE 10

Create the skeleton

slide-11
SLIDE 11

Define the log

slide-12
SLIDE 12

Create a helper function

slide-13
SLIDE 13

SSL Client Hello

slide-14
SLIDE 14

SSL Server Hello

slide-15
SLIDE 15

Certificates

slide-16
SLIDE 16

server_name extension

slide-17
SLIDE 17

Finish the log