Is there anything out there Bro wise that can do ssdeep hashing? Thanks.
Sounds like an interesting plugin to write.
Sounds like an interesting plugin to write.
Yes and no. 
There's a way to do this in C++, but there's no script framework for
it. The main reason is performance -- this is really something that
needs to happen in the core (that is, in C++) as opposed to in a script.
Relevant examples would be:
https://github.com/bro/bro/blob/master/src/OpaqueVal.cc
https://github.com/bro/bro/blob/master/src/file_analysis/analyzer/hash/Hash.h
--Vlad
Mark Buchanan <mabuchan@gmail.com> writes: