Bringing Bro to the Enterprise Comprehensive Visibility & - - PowerPoint PPT Presentation

▶
bringing bro to the enterprise
SMART_READER_LITE
LIVE PREVIEW

Bringing Bro to the Enterprise Comprehensive Visibility & - - PowerPoint PPT Presentation

Dec 25, 2022 238 likes •649 views

Bringing Bro to the Enterprise Comprehensive Visibility & Response for Every Corner of Your Network Robin Sommer International Computer Science Institute, & Broala, LLC robin@icsi.berkeley.edu robin@broala.com

slide-1
SLIDE 1

Robin Sommer

International Computer Science Institute, & Broala, LLC

robin@icsi.berkeley.edu robin@broala.com http://www.icir.org/robin

Bringing Bro to the Enterprise

Comprehensive Visibility & Response for Every Corner of Your Network

slide-2
SLIDE 2

Bringing Bro to the Enterprise

Outline

Bro Overview

A production-quality open-source network monitor.

A Bit of Bro History

From academic research to enterprise deployment.

Enterprise Solutions

Roadmap for deep visibility and control.

2

slide-3
SLIDE 3

Bringing Bro to the Enterprise

The Bro Platform

3

Network Programming Language Packet Processing Standard Library Platform

Intrusion Detection Network Visibility Vulnerability Management Compliance Monitoring Traffic Measurement Traffic Control

Analysis Tap

Open Source BSD License

slide-4
SLIDE 4

Bringing Bro to the Enterprise

“What Can It Do?”


4

“Network ground truth”

Alerts Custom Logic Log Files

slide-5
SLIDE 5

Bringing Bro to the Enterprise

Bro’s Log Files

5

Rich, structured, real-time activity streams.

Bro

Traffic

Network

Logs

slide-6
SLIDE 6

Bringing Bro to the Enterprise

Connections Logs

6

conn.log

ts 1393099415.790834

Timestamp

uid CSoqsg12YRTsWjYbZc

Unique ID

id.orig_h 2004:b9e5:6596:9876:[…]

Originator IP

id.orig_p 59258

Originator Port

id.resp_h 2b02:178:2fde:bff:[…]

Responder IP

id.resp_p 80

Responder Port

proto tcp

IP Protocol

service http

App-layer Protocol

duration 2.105488

Duration

  • rig_bytes

416

Bytes by Originator

resp_bytes 858

Bytes by Responder

conn_state SF

TCP state

local_orig F

Local Originator?

missed_bytes

Gaps

history ShADafF

State History

tunnel_parents Cneap78AnVWoA1yml

Outer Tunnels

slide-7
SLIDE 7

Bringing Bro to the Enterprise

HTTP

7

http.log

ts 1393099291.589208 uid CKFUW73bIADw0r9pl id.orig_h 2a07:f2c0:90:402:41e:c13:6cb:99c id.orig_p 54352 id.resp_h 2406:fe60:f47::aaeb:98c id.resp_p 80 method POST host com-services.pandonetworks.com uri /soapservices/services/SessionStart referrer

  • user_agent

Mozilla/4.0 (Windows; U) Pando/2.6.0.8 status_code 200 username anonymous password

  • rig_mime_types

application/xml resp_mime_types application/xml

slide-8
SLIDE 8

Bringing Bro to the Enterprise

SSL

ts 1392805957.927087 uid CEA05l2D7k0BD9Dda2 id.orig_h 2a07:f2c0:90:402:41e:c13:6cb:99c id.orig_p 40475 id.resp_h 2406:fe60:f47::aaeb:98c id.resp_p 443 version TLSv10 cipher TLS_DHE_RSA_WITH_AES_256_CBC_SHA server_name www.netflix.com subject CN=www.netflix.com,OU=Operations, O=Netflix, Inc.,L=Los Gatos, ST=CALIFORNIA,C=US issuer_subject CN=VeriSign Class 3 Secure Server CA, OU=VeriSign Trust Network,O=VeriSign, C=US not_valid_before 1389859200.000000 not_valid_after 1452931199.000000 client_subject

  • client_issuer_subject
  • cert_hash

197cab7c6c92a0b9ac5f37cfb0699268 validation_status

  • k

8

ssl.log

slide-9
SLIDE 9

Bringing Bro to the Enterprise

Software

9

software.log

ts 1392796839.675867 host 10.209.100.2 host_p

  • software_type

HTTP::BROWSER name DropboxDesktopClient version.major 2 version.minor 4 version.minor2 11 version.minor3

  • version.addl

Windows unparsed_version DropboxDesktopClient/2.4.11 (Windows; 8; i32; en_US; Trooper 5694-2047-1832-6291-8315)

slide-10
SLIDE 10

Bringing Bro to the Enterprise

Files

10

files.log

ts 1392797643.447056 fuid FnungQ3TI19GahPJP2 tx_hosts 191.168.187.33 rx_hosts 10.1.29.110 conn_uids CbDgik2fjeKL5qzn55 source SMTP analyzers SHA1,MD5 mime_type application/x-dosexec filename Letter.exe duration 5.320822 local_orig T seen_bytes 39508 md5 93f7f5e7a2096927e06e[…]1085bfcfb sha1 daed94a5662a920041be[…]a433e501646ef6a03

slide-11
SLIDE 11

Bringing Bro to the Enterprise

“What Can It Do?”


11

“Network Ground Truth”

Alerts Custom Logic Log Files

“Watch this!” Record & trigger actions “Don’t ask what Bro can do. Ask what you want it to do.”

slide-12
SLIDE 12

Bringing Bro to the Enterprise

Typical Deployment

12

Bro System NIC

Bro Bro Bro Bro Bro

1/10G

Border Gateway

Internet LAN

1/10G

Logs & Alerts

slide-13
SLIDE 13

Bringing Bro to the Enterprise

Cluster Deployment

13

100G

Border Gateway

Internet LAN

Bro Cluster

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Load-balancer

10G 10G 10G 10G

100G

Logs & Alerts

slide-14
SLIDE 14

Bringing Bro to the Enterprise

“Who’s Using It?”

Community

50/90/150/180 attendees at BroCon ’12/’13/’14/‘15 110 organizations at BroCon ‘15 4,500 Twitter followers 1,000 mailing list subscribers 100 users average on IRC channel 10,000 direct downloads / version from 150 countries

14

Installations across the Country

Universities Research Labs Supercomputing Centers Government Organizations Fortune 20 Enterprises

Update

BroCon 2015, MIT

Fully integrated into Security Onion

Popular security-oriented Linux distribution

slide-15
SLIDE 15

Bringing Bro to the Enterprise

A Bit of Bro History

From Academic Research To Enterprise Deployment

15

slide-16
SLIDE 16

Bringing Bro to the Enterprise

Bro History

16

1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2011 1995 2010 1996 2012

Vern writes 1st line

  • f code

2013 2014

USENIX Paper Backdoors Stepping Stones Anonymizer
 Active Mapping Context Signat. TRW
 State Mgmt.

  • Independ. State

Host Context Time Machine Enterprise Traffic BinPAC DPD 2nd Path Bro Cluster
 Shunt Autotuning Parallel Prototype

Academic Publications

Input Framework SSL Trust Relationships Summary Stats HILTI DPI Concurrency PLC Modeling

Bro Center

v2.3 Performance SNMP, Radius, SSL++

Bro SDCI

v2.0 User Experience v0.2 1st CHANGES entry v0.6 RegExps Login analysis v0.8aX/0.9aX
 SSL/SMB

STABLE releases

BroLite v1.1/v1.2 when Stmt Resource tuning Broccoli DPD v1.5 BroControl v0.7a90 Profiling State Mgmt v1.4 DHCP/BitTorrent HTTP entities NetFlow Bro Lite Deprecated v1.0 BinPAC IRC/RPC analyzers 64-bit support Sane version numbers v0.4
 HTTP analysis Scan detector IP fragments
 Linux support v0.7a175/0.8aX Signatures SMTP IPv6 support User manual

v0.7a48 Consistent CHANGES

v1.3 Ctor expressions GeoIP Conn Compressor 0.8a37 Communication Persistence Namespaces Log Rotation LBNL starts using Bro

  • perationally

v2.1 IPv6 Input Framew. v2.2 File Analysis Summary Stats

2015 2016

v2.4 Broker, Plugins, DTLS/KRB NetControl VAST Tor Traffic

slide-17
SLIDE 17

Bringing Bro to the Enterprise

A Tale of Two Users

17

Science & Higher Education

Happy to experiment. Used to open-source software. Driven by skilled individuals. Limited funding.

Bro Center of Expertise

Enterprises & Government

Used to purchasing solutions. Require reliable point of contact. Avoid dependence on individuals. More flexible budgets.

slide-18
SLIDE 18

Bringing Bro to the Enterprise

18

Enterprise-grade Bro solutions, from the creators of Bro.

Commercial Bro support plans. Plug & play Bro appliances.

BroBox One

Visibility, made elegantly simple.

Bro logs and file extraction. Export to Kafka, Splunk, Syslog, SFTP. Aggressively tuned for performance. Zero maintenance, ready for the future.

slide-19
SLIDE 19

Bringing Bro to the Enterprise

Advantage: Integration

19

With BroBox One we are controlling the full stack. We can take integration much further, while maintaining the open-source spirit.

Bro System NIC

Bro Bro Bro Bro Bro

1 year

slide-20
SLIDE 20

Bringing Bro to the Enterprise

20

Enterprise Solutions

Roadmap for deep visibility and control

slide-21
SLIDE 21

Bringing Bro to the Enterprise

Monitoring Enterprise Environments

21

Enterprise Network Enterprise Network

From perimeter to internal. From standalone to coordinated. From passive to active.

Bro’s open-source roadmap is full of functionality to support all of this.

slide-22
SLIDE 22

Bringing Bro to the Enterprise

Bro Cluster

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

Node NIC

Bro Bro Bro Bro Bro

10G 10G 10G 10G

Load-balancer

Monitoring Internal Traffic

22

LBNL’s Pragmatic Approach: The “Internal Cluster”

Subnet 1 Subnet 2 Subnet 3 Subnet 4

slide-23
SLIDE 23

Bringing Bro to the Enterprise

Vision: Deep Cluster

23

Bro Bro Bro Bro Bro Bro Bro Bro

Local Clusters

Example: Geographically distributed organization.

Bro

US

Bro

UK

Bro

FR

Bro

CN

Regional Heads Global Master Bro

  • Config. &

Mgmt. Logs & Alarms

slide-24
SLIDE 24

Bringing Bro to the Enterprise

Foundation: Broker

24

Bro’s new unified communication library.

Public/subscribe. APIs for Bro, C++, C, Python. BSD license. Log forwarding. Event exchange. Global key/value stores.

http://github.com/bro/broker

slide-25
SLIDE 25

Bringing Bro to the Enterprise

Global Coordination with Broker

25

Bro Bro Bro Bro Bro Bro Bro Bro

Bro

US

Bro

UK

Bro

FR

Bro

CN

Bro

Global

  • Config. &

Mgmt. Logs & Alarms

Data Store Data Store Data Store Data Store

Data Store

Events State

Global correlation through message passing. Global state through persistent data stores.

slide-26
SLIDE 26

Bringing Bro to the Enterprise

Bro’s Summary Statistics

26 Master Sensor 1 Tap Observation Reducer Result Observation Reducer Result Sensor n Tap Observation Reducer Result Observation Reducer Result Merger Merger Predicate Trigger Result Result Notify Values & Poll N

  • t

i f y & P

  • l

l Values Observation Reducer Statistical Framework Results & Outputs

Summary Statistics

“Bro’s version of MapReduce.”

Comes with Bro for the classic cluster. Deep Cluster support in planing.

slide-27
SLIDE 27

Bringing Bro to the Enterprise

Integrating Host Monitoring

27

Host Host

…

Bro Bro Bro Bro Bro Bro Bro Bro

Bro Bro Bro Bro

Bro

Leverage control over end hosts.

https://osquery.io

Source: Facebook

slide-28
SLIDE 28

Bringing Bro to the Enterprise

Broker Plugin for osquery

28

https://github.com/bro/bro-osquery

event bro_init() { […] local ev = [$ev=processes, $query="SELECT pid, path, cmdline, uid, gid FROM processes"];

  • squery::subscribe(ev);

} event processes(host: string, pid: int, path: string, cmdline: string, uid: int, gid: int) { Log::write(LOG, […]); }

#fields t host pid path uid gid argv 1453849601.880629 127.0.0.1 40136 /usr/bin/git 10000 10000 git diff --no-ext-diff --quiet --exit-code 1453849643.924678 127.0.0.1 40397 /usr/bin/git 10000 10000 git push 1453849643.924678 127.0.0.1 40404 /usr/bin/ssh 10000 10000 ssh git@github.com git-receive-pack '/bro-osquery'

processes.log

slide-29
SLIDE 29

Bringing Bro to the Enterprise

From Passive to Active

29

Bro is not an inline solution. But it can still talk to your network. Examples Shunting Dynamic Firewall

slide-30
SLIDE 30

Bringing Bro to the Enterprise

Cluster with Shunting

30

100G

Border Gateway

Internet LAN

Bro Cluster Load-balancer

10G 10G 10G 10G

100G

API

Shunting

“Uninteresting!”

slide-31
SLIDE 31

Bringing Bro to the Enterprise

Shunting at Berkeley Lab

31

Very effective with heavy-tailed network loads.

Source: Lawrence Berkeley National Laboratory

slide-32
SLIDE 32

Bringing Bro to the Enterprise

Cluster with Dynamic Firewall

32

100G

Border Gateway

Internet LAN

Bro Cluster Load-balancer

10G 10G 10G 10G

100G

API

Blocking

“Block it!”

slide-33
SLIDE 33

Bringing Bro to the Enterprise

Dynamic Firewall Example

33

Source: Indiana University

Managing 1000s of blocks with “catch & release”.

slide-34
SLIDE 34

Bringing Bro to the Enterprise

Foundation: Bro’s NetControl Framework

34

Current Backends OpenFlow, iptables, acld.

drop_connection (connection, timeout) drop_address (host, timeout) shunt_flow (flow, timeout) redirect (flow, port, timeout)

High-level script API to talk to network equipment.

https://github.com/bro/bro-netcontrol

slide-35
SLIDE 35

Bringing Bro to the Enterprise

BYOBro

35

Central aggregation & management. Global state & correlation. Dynamic firewall and shunting. Bro Frameworks. Broker communication library.

  • squeryd integration.

Intelligence integration. Enterprise context. Authentication framework. Dynamic reconfiguration. Enterprise & domain protocols. Comprehensive Archival. Scalability & performance.

Build your own solution. All this is there, or coming — all open-source.

slide-36
SLIDE 36

Bringing Bro to the Enterprise

Opportunity: Integration, Part II.

36

Broala is building a turn-key solution to operate Bro at scale.

Range of BroBox Models

Backbone, data center,

  • ffices, factory floor, cloud.

Central Fleet Management

California

Facility Bro Box Bro Box Bro Box Relay Facility Bro Box Bro Box Bro Box Facility Bro Box Bro Box Bro Box Relay Facility Bro Box Bro Box Bro Box

Ohio Backend

Global aggregation, correlation, & management across 100s of locations.

Active Response

BroBox

Control Record Monitor

Switch

LAN LAN LAN LAN WAN

Dynamic firewall.

Help us prioritize!

slide-37
SLIDE 37

Bringing Bro to the Enterprise

Join the Bro Community

37

Broala is just one of many companies leveraging Bro. Joint goal: A sustainable long-term open-source model. Software Freedom Conservancy

Fiscal sponsor & neutral 3rd party.

Bro Leadership Team

Steering Committee including community members.

Bro Future Fund

Precious metal sponsorships.

slide-38
SLIDE 38

Bringing Bro to the Enterprise

Conclusion

38

slide-39
SLIDE 39

Bringing Bro to the Enterprise

The Bro Team is working to bring Bro to the enterprise.

39

From perimeter to internal. From standalone to coordinated. From passive to active. Build your own solution. Or come talk to us at Broala.

slide-40
SLIDE 40

The Bro Project www.bro.org info@bro.org @Bro_IDS Commercial Bro Solutions www.broala.com info@broala.com @Broala_

The U.S. National Science Foundation has enabled much of Bro.

Bro is coming out of two decades of academic research, along with extensive transition to practice efforts. NSF has supported much of that, and is currently funding the Bro Center of Expertise at the International Computer Science Institute and the National Center for Supercomputing Applications.

The Bro Project is a member of Software Freedom Conservancy.

Software Freedom Conservancy, Inc. is a 501(c)(3) not-for- profit organization that helps promote, improve, develop, and defend Free, Libre, and Open Source Software projects.

Upcoming Bro Events

March 15 Bro4Pros @ Mozilla, San Francisco, CA April 18 EDUCAUSE Training, Seattle, OR Sep 13–15 BroCon 2016, Austin, TX