# Bro scripts

**URL:** <https://community.zeek.org/t/bro-scripts/1687>\
**Category:** Zeek\
**Created:** [October 28, 2010, 3:56pm UTC](https://community.zeek.org/t/bro-scripts/1687 "2010-10-28T15:56:29Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 28, 2010, 3:56pm UTC](https://community.zeek.org/t/bro-scripts/1687/1 "2010-10-28T15:56:29Z")

</div>

Hi all,

I'm doing work on Bro's policy scripts for the next release and I want to find policy scripts floating around that can be shared and any helpful code snippets. Anything you can contribute would be greatly appreciated, thanks!

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [October 29, 2010, 12:59am UTC](https://community.zeek.org/t/bro-scripts/1687/2 "2010-10-29T00:59:36Z")

</div>

> I'm doing work on Bro's policy scripts for the next release and I want  
> to find policy scripts floating around that can be shared and any  
> helpful code snippets. Anything you can contribute would be greatly  
> appreciated, thanks!

The whole buzz about Firesheep caused me to hack up a sidejacking  
detector. I haven't tested it because I literally wrote it 5 minutes  
ago.

&nbsp;&nbsp;&nbsp;Matthias

Here is the code:

&nbsp;&nbsp;&nbsp;&nbsp;@load http-request  
&nbsp;&nbsp;&nbsp;&nbsp;@load http-reply

&nbsp;&nbsp;&nbsp;&nbsp;module HTTP;

&nbsp;&nbsp;&nbsp;&nbsp;export  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;redef enum Notice += { CookieReuse };

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# Number of cookies per client.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const max\_cookies = 1 &redef;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# The time after when we expiring entries.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;const cookie\_expiration = 1 hr &redef;  
&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;# Count the number of cookies per client.  
&nbsp;&nbsp;&nbsp;&nbsp;global cookies: table[string] of set[addr] &write\_expire = cookie\_expiration;

&nbsp;&nbsp;&nbsp;&nbsp;event http\_header(c: connection, is\_orig: bool, name: string, value: string)  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# We are only looking for session IDs in the client cookie header.  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (! (is\_orig && name == /[cC][oO][oO][kK][iI][eE]/))  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local client = c$id$orig\_h;  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (value !in cookies)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cookies[value] = set();  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;add cookies[value][client];

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (|cookies[value]| \<= max\_cookies)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local s = lookup\_http\_request\_stream(c);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NOTICE([$note=CookieReuse, $src=client,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$msg=fmt("potential sidejacking by %s: cookie used by %d addresses",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;client, |cookies[value]|)]);  
&nbsp;&nbsp;&nbsp;&nbsp;}

---

<div class="post-metadata">

**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\
**Post date:** [October 29, 2010, 1:48am UTC](https://community.zeek.org/t/bro-scripts/1687/3 "2010-10-29T01:48:30Z")

</div>

That's pretty cool! I do have one suggestion, though: Instead of  
tracking by IP, how about one cookie per user agent? That will help  
catch the side jacking when used under a NAT.

---

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [October 29, 2010, 3:23am UTC](https://community.zeek.org/t/bro-scripts/1687/4 "2010-10-29T03:23:03Z")

</div>

Good point! Changing the tracking global from...

global cookies: table[string] of set[addr]  
to...  
global cookies: table[string] of set[addr, string]e

and then storing the user-agent in the last string would take care of that.

I think your point about NAT gets to a more general point of what techniques could we use to detect NAT? I know that there are a lot of little indicators of addresses that are doing NAT, but I think it could be really worthwhile to organize them all and then write a script to implement all of them so that we can get reliable NAT detection with Bro. I can start with a few thoughts.

\* Multiple web browser user-agents at a single address  
&nbsp;&nbsp;&nbsp;&nbsp;- Must match some regex for a "real" browser so that weird applications throwing junk in the user-agent don't trigger this.  
&nbsp;&nbsp;&nbsp;&nbsp;- Must be closely together in time.

Over the past several years I've had a lot of ideas for detecting NATs, but they have all completely escaped me. Anyone else have thoughts to add to this?

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\
**Post date:** [October 29, 2010, 4:50am UTC](https://community.zeek.org/t/bro-scripts/1687/5 "2010-10-29T04:50:26Z")

</div>

I think that will definitely work for detecting NAT's if you stick to  
regexing the variants on the major browsers. As we've all seen, most  
browser plugins have their own UA, so you're bound to get many UA's  
out of a single computer naturally, but they should not all be for  
Internet Explorer, for example. I think scoping to IE, FF, and Webkit  
engines would be good enough to be effective.

One other point, once a NAT is detected, would it be possible to  
exclude that IP from future detection to save resources? I'm a bit  
concerned with memory utilization for all of these state tables.

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [October 29, 2010, 6:56am UTC](https://community.zeek.org/t/bro-scripts/1687/6 "2010-10-29T06:56:15Z")

</div>

> \> Instead of tracking by IP, how about one cookie per user agent?
> 
> Good point!

Indeed.

> global cookies: table[string] of set[addr]  
> to...  
> global cookies: table[string] of set[addr, string]e

That will almost do it, except that I now need to write a handler for  
http\_all\_headers instead of http\_header to obviate the need for some  
global glue code.

Furthermore, the Cookie header often bundles a bunch of cookie key-value  
pairs of which only a few define the actual user session. The others can  
vary and thus cause false negatives. Firesheep fortunately ships with a  
bunch of handlers for major sites which I will use a baseline to  
define user session for specific sites, i.e.,

&nbsp;&nbsp;&nbsp;&nbsp;# Distills relevant cookies that define a user session.  
&nbsp;&nbsp;&nbsp;&nbsp;type user\_session: record  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;url: pattern; # URL  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cookies: pattern; # Cookie keys that define the user session.  
&nbsp;&nbsp;&nbsp;&nbsp;};

&nbsp;&nbsp;&nbsp;&nbsp;const session\_info: table[string] of user\_session =  
&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Amazon"] = [$url=/amazon.com/, $cookies=/x-main/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Dropbox"] = [$url=/dropbox.com/, $cookies=/lid/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Facebook"] = [$url=/facebook.com/, $cookies=/xs|c\_user|sid/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Flickr"] = [$url=/flickr.com/, $cookies=/cookie\_session/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Google"] = [$url=/google.com/, $cookies=/NID|SID|HSID|PREF/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["NY Times"] = [$url=/nytimes.com/, $cookies=/NYT-s|nyt-d/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Twitter"] = [$url=/twitter.com/, $cookies=/\_twitter\_sess/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Yelp"] = [$url=/yelp.com/, $cookies=/\_\_utma/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Windows Live"] = [$url=/live.com/,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$cookies=/MSP(Prof|Auth)|RPSTAuth|NAP/],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["Wordpress"] = [$url=/yelp.com/,  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$cookies=/wordpress\_[0-9a-fA-F]+/]  
&nbsp;&nbsp;&nbsp;&nbsp;} &redef;

What remains todo is to split the Cookie string into its key-value pairs  
and then match the keys against user\_session$cookies. Instead of regular  
expression, I'd preferably have a set[string], but this cannot be  
statically defined in a record, i.e.,

&nbsp;&nbsp;&nbsp;&nbsp;["Facebook"] = [$url=/facebook.com/, $cookies={"xs", "c\_user", "sid"}],  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^^^^^^^^^^^^^^^^^^^^^^^  
appears not to be correct Bro syntax, because I think variable-size  
types inside records cannot be initialized statically. Is that correct?  
If so, I'd probably change to simple table[string] of set[string] to  
represent user sessions.

In any case, the downside is that this would only detect sidejacking for  
known sites. I think it would make sense to do the following. If a  
profile for a user\_session for a particular site (as defined above)  
exists, use it, and otherwise use the entire cookie value.

> I think your point about NAT gets to a more general point of what  
> techniques could we use to detect NAT?

This is truly an important issue to tackle. I wonder if it is possible  
to have better abstractions in Bro to support user-based analysis. For  
example, it would be neat to augment several events with a "user"  
argument which is a essentially a record filled by many other events. In  
HTTP for example, some code would parse the User-Agent and fill this  
record, so that the script writer could simply refer to user$os or  
user$browser.

&nbsp;&nbsp;&nbsp;Matthias

---

<div class="post-metadata">

**Author:** ![Justin\_Azoff](https://avatars.discourse-cdn.com/v4/letter/j/eb9ed0/32.png) [@Justin\_Azoff](https://community.zeek.org/u/Justin_Azoff)\
**Post date:** [October 29, 2010, 1:12pm UTC](https://community.zeek.org/t/bro-scripts/1687/7 "2010-10-29T13:12:40Z")

</div>

Using user-agents for this is tricky. I've written some code to analyze  
the output of your http-user-agents.log in splunk, and found that the  
best thing to look at is the architecture and os, and ignore the  
browser itself.

the script I use is here:

[http://github.com/JustinAzoff/splunk-scripts/blob/master/ua2os.py](http://github.com/JustinAzoff/splunk-scripts/blob/master/ua2os.py)

it's for use in splunk, but it's 90% regexes, stuff like this:

os\_mapping = (  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows .. 5.1', 'Windows XP'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows .. 5.2', 'Windows XP'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows NT 6.0', 'Windows Vista'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows 6.0', 'Windows Server 2008'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows NT 6.1', 'Windows 7'),  
&nbsp;&nbsp;&nbsp;&nbsp;('OS X 10.5', 'MAC OS X 10.5.x'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Darwin', 'MAC OS X other'),  
&nbsp;&nbsp;&nbsp;&nbsp;...  
&nbsp;&nbsp;&nbsp;&nbsp;('Android', 'Android'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Linux ', 'Linux'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows', 'Windows - Other'),  
&nbsp;&nbsp;&nbsp;&nbsp;('iPad', 'ipad'),  
&nbsp;&nbsp;&nbsp;&nbsp;('iPod', 'ipod'),  
&nbsp;&nbsp;&nbsp;&nbsp;('iPhone', 'iphone'),  
)

arch\_mapping = (  
&nbsp;&nbsp;&nbsp;&nbsp;('Windows .. 5.2', 'x64'),  
&nbsp;&nbsp;&nbsp;&nbsp;('x64', 'x64'),  
&nbsp;&nbsp;&nbsp;&nbsp;...  
&nbsp;&nbsp;&nbsp;&nbsp;('iPad', 'ipad'),  
&nbsp;&nbsp;&nbsp;&nbsp;('iPod', 'ipod'),  
&nbsp;&nbsp;&nbsp;&nbsp;('iPhone', 'iphone'),  
&nbsp;&nbsp;&nbsp;&nbsp;('Intel', 'Intel'),  
)

It is not uncommon to have one machine using multiple browsers, but rare  
for it to indentify as both Vista and Windows 7, or both i386 and x64, or  
Windows XP and Mac OS X 10.5.

Also, some user-agents can immediately identify NAT: iOS and android  
devices do not have ethernet interfaces, so if one of these devices is  
found on a non-wireless subnet it indicates the presense of a rogue access  
point.

---

<div class="post-metadata">

**Author:** ![Martin\_Holste](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@Martin\_Holste](https://community.zeek.org/u/Martin_Holste)\
**Post date:** [October 29, 2010, 1:53pm UTC](https://community.zeek.org/t/bro-scripts/1687/8 "2010-10-29T13:53:03Z")

</div>

Thanks for sharing that. Obviously in a corporate environment (or any  
in which desktops are managed) most user agents will appear the same  
because they are all running the same browser version. However, I  
have seen that for guest wireless and other public access points, the  
amount of plugins, .NET versions, etc. makes the UA's fairly unique,  
so off the bat your mileage will vary depending on the client class.  
Using the detected OS would certainly be more accurate, but the  
chances of an attacker having the same OS as the victim are pretty  
good, so you'll obviously have to deal with a lot of false negatives.  
Maybe concatenating the p0f signature with the user agent is the best  
way to get a pseudo machine ID.

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [October 29, 2010, 11:35pm UTC](https://community.zeek.org/t/bro-scripts/1687/9 "2010-10-29T23:35:14Z")

</div>

> I think it would make sense to do the following. If a profile for a  
> user\_session for a particular site (as defined above) exists, use it,  
> and otherwise use the entire cookie value.

Attached is the full version of the sidejacking detector that includes  
all the Firesheep handlers. I tested it for Twitter, Amazon, and Google.  
The script successfully reports alarms when I hijack my own connections  
with Firesheep.

&nbsp;&nbsp;&nbsp;Matthias

[sidejack.bro](https://community.zeek.org/uploads/short-url/cds6Mk2MnY0o632938tp7UQrWzh.bro) (4.51 KB)

---

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [October 30, 2010, 8:52pm UTC](https://community.zeek.org/t/bro-scripts/1687/10 "2010-10-30T20:52:00Z")

</div>

> expression, I'd preferably have a set[string], but this cannot be  
> statically defined in a record, i.e.,
> 
> &nbsp;&nbsp;&nbsp;&nbsp;["Facebook"] = [$url=/facebook.com/, $cookies={"xs", "c\_user", "sid"}],  
> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^^^^^^^^^^^^^^^^^^^^^^^  
> appears not to be correct Bro syntax, because I think variable-size  
> types inside records cannot be initialized statically. Is that correct?

You can construct sets using

&nbsp;&nbsp;.... $cookies=set("xs", "c\_user", "sid")

for example.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\
**Post date:** [October 31, 2010, 10:38pm UTC](https://community.zeek.org/t/bro-scripts/1687/11 "2010-10-31T22:38:46Z")

</div>

Hi,

I've played around with NAT detection based on user-agent strings and IP  
TTL.  
See [http://www.icir.org/gregor/papers/gregor-phd.pdf](http://www.icir.org/gregor/papers/gregor-phd.pdf), Chapter 4

cu  
gregor

---

<div class="post-metadata">

**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\
**Post date:** [November 1, 2010, 9:13pm UTC](https://community.zeek.org/t/bro-scripts/1687/12 "2010-11-01T21:13:36Z")

</div>

> &nbsp;&nbsp;.... $cookies=set("xs", "c\_user", "sid")

That works, thanks.

I attached a revamped version of the sidejacking detector which should  
exhibit less false positives now (and has slightly improved logging).

&nbsp;&nbsp;&nbsp;Matthias

[sidejack.bro](https://community.zeek.org/uploads/short-url/kLchG2yrk4OzXn7Ji8Y9zVGcads.bro) (5.65 KB)

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/bro-scripts/1687/13 "2022-05-06T15:39:13Z")

</div>