bro 2.5 . How to get meta fields on intel.log

Zeek
1

Hi ,

How can we get working those bro extensions for Bro 2.4 on Bro 2.5
Currently I get errors:

error in /opt/bro/share/bro/base/frameworks/intel/./main.bro, line 155: already defined (Intel::extend_match)
internal warning in /opt/bro/share/bro/my_scripts/intel-ext/./scripts/main.bro, line 20: Duplicate identifier documentation: Intel::extend_match
proxy scripts failed.
error in /opt/bro/share/bro/base/frameworks/intel/./main.bro, line 155: already defined (Intel::extend_match)
internal warning in /opt/bro/share/bro/my_scripts/intel-ext/./scripts/main.bro, line 20: Duplicate identifier documentation: Intel::extend_match
ids-nksc004-eth1-1 scripts failed.
error in /opt/bro/share/bro/base/frameworks/intel/./main.bro, line 155: already defined (Intel::extend_match)
internal warning in /opt/bro/share/bro/my_scripts/intel-ext/./scripts/main.bro, line 20: Duplicate identifier documentation: Intel::extend_match

Our intel data have following format :

#fields indicator indicator_type meta.desc meta.cif_confidence meta.source

And we need to have these meta’s: meta.desc, meta.cif_confidence, meta.source on bro.intel log as previously had with bro extensions for Bro 2.4 found on https://github.com/sethhall/intel-ext

.

Or question is how to get meta fields on bro intel.log.?

2

Hi,

How can we get working those bro extensions for Bro 2.4 on Bro 2.5
Currently I get errors:
...
line 20: Duplicate identifier documentation: Intel::extend_match

the intel framework has been reworked for 2.5 and includes a similar
extension mechanism (a hook instead of an event). The following blog
entry goes into details:
http://blog.bro.org/2016/12/the-intelligence-framework-update.html

Or question is how to get meta fields on bro intel.log.?

You can use the extension mechanisms included but keep in mind that each
hit might be associated with multiple indicators and each indicator
might be associated with multiple meta data records.

Jan

3

Thanks, Jan
Got it working .

4

Sorry about the confusion. I'll put a note on that repository that the feature is now built into Bro and point to Jan's blog post.

  .Seth