# Bro detection scripts updates

**URL:** <https://community.zeek.org/t/bro-detection-scripts-updates/3515>\
**Category:** Zeek\
**Created:** [March 11, 2015, 9:30pm UTC](https://community.zeek.org/t/bro-detection-scripts-updates/3515 "2015-03-11T21:30:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kellogg\_Brian\_GS\_IT](https://avatars.discourse-cdn.com/v4/letter/k/f05b48/32.png) [@Kellogg\_Brian\_GS\_IT](https://community.zeek.org/u/Kellogg_Brian_GS_IT)\
**Post date:** [March 11, 2015, 9:30pm UTC](https://community.zeek.org/t/bro-detection-scripts-updates/3515/1 "2015-03-11T21:30:34Z")

</div>

I'm going through and updating the NOTICEs for different detection scripts built into Bro. Trying to get the generated NOTICE logs set correctly for ELSA to parse. It is working but I'm not sure if I'm doing this the most Bro appropriate way. Couple questions:

Is this the best way to accomplish this task? Secondly, if advisable, how do we get these script changes incorporated into Bro base? I'm not that experienced with git but willing to learn more if needed. These changes were made, again, to benefit ELSA searching/grouping and for the Bro correlation script recently released.

Here's what I changed/add to some of the built-in detection scripts (Lines with "+" are what I changed/added):

/opt/bro/share/bro/policy/protocols/ssh/detect-bruteforcing.bro  
NOTICE([$note=Password\_Guessing,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=fmt("%s appears to be guessing SSH passwords (seen in %d connections).", key$host, r$num),  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$sub=sub\_msg,  
+ #$src=key$host,  
+ $id=[$orig\_h=key$host,$orig\_p=0/tcp,$resp\_h=0.0.0.0,$resp\_p=0/tcp],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(key$host)]);  
}]);

/opt/bro/share/bro/policy/protocols/ftp/detect-bruteforcing.bro  
NOTICE([$note=FTP::Bruteforcing,  
+ #$src=key$host,  
+ $id=[$orig\_h=key$host,$orig\_p=0/tcp,$resp\_h=0.0.0.0,$resp\_p=0/tcp],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=message,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(key$host)]);  
}]);

/opt/bro/share/bro/policy/protocols/http/detect-sqli.bro  
NOTICE([$note=SQL\_Injection\_Attacker,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg="An SQL injection attacker was discovered!",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$email\_body\_sections=vector(format\_sqli\_samples(r$samples)),  
+ #$src=key$host,  
+ $id=[$orig\_h=key$host,$orig\_p=0/tcp,$resp\_h=0.0.0.0,$resp\_p=0/tcp],  
+ $sub=cat(format\_sqli\_samples(r$samples)),  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(key$host)]);  
}]);

…

NOTICE([$note=SQL\_Injection\_Victim,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg="An SQL injection victim was discovered!",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$email\_body\_sections=vector(format\_sqli\_samples(r$samples)),  
+ #$src=key$host,  
+ $id=[$orig\_h=0.0.0.0,$orig\_p=0/tcp,$resp\_h=key$host,$resp\_p=0/tcp],  
+ $sub=cat(format\_sqli\_samples(r$samples)),  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(key$host)]);  
}]);

/opt/bro/share/bro/policy/misc/scan.bro  
NOTICE([$note=Address\_Scan,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#$src=key$host,  
+ $id=[$orig\_h=key$host,$orig\_p=0/tcp,$resp\_h=0.0.0.0,$resp\_p=key$str],  
+ #$p=to\_port(key$str),  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$sub=side,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=message,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(key$host)]);  
}]);

…

NOTICE([$note=Port\_Scan,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#$src=key$host,  
+ $id=[$orig\_h=key$host,$orig\_p=0/tcp,$resp\_h=key$str,$resp\_p=0/tcp],  
+ #$dst=to\_addr(key$str),  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$sub=side,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=message,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(key$host)]);  
}]);

/opt/bro/share/bro/policy/misc/detect-traceroute/main.bro  
NOTICE([$note=Traceroute::Detected,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=fmt("%s seems to be running traceroute using %s", src, proto),  
+ #$src=src,  
+ $id=[$orig\_h=src,$orig\_p=0/icmp,$resp\_h=dst,$resp\_p=0/icmp],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$identifier=cat(src,proto)]);  
}]);

Thanks,  
-Brian

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [March 12, 2015, 1:53am UTC](https://community.zeek.org/t/bro-detection-scripts-updates/3515/2 "2015-03-12T01:53:54Z")

</div>

You might be right in how you’ve done this. I never felt very comfortable with how this ended up getting implemented. I’ll file a ticket and see if I can address the ones you’ve pointed out and see if there are anymore. I’ll probably also mark the src and dst fields as deprecated and maybe do a reporter message if they’re ever used (to give people a bit of breathing room before we break any existing scripts they have).

Here’s the ticket in case you or anyone else wants to comment on it:  
&nbsp;&nbsp;[https://bro-tracker.atlassian.net/browse/BIT-1339](https://bro-tracker.atlassian.net/browse/BIT-1339)  
  
Great suggestion, thanks!  
.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/bro-detection-scripts-updates/3515/3 "2022-05-06T15:42:31Z")

</div>