Various OSs detection using Bro

Zeek
1

I was wondering if anyone has tried detecting different OSs using Bro.
I know Bro ships with windows version detection script, and to add to the OS
detection, I have written two more scripts to detect MacOS and iOS.

Next, was trying to write something to detect Linux OSs, for Android phones
and other PCs that might be running some kind of Linux OS.

So, before trying to re-invent the wheel, wanted to ask if some one trying to address
similar use-case, and if would like to share the scripts, or if someone has any pointers to
any specific way of detection and have any pointers in that direction! :slight_smile:

Thanks,
Fatema.

2

https://github.com/bro/bro/blob/master/scripts/base/misc/p0f.fp ?

We used it before and it was very false positive prone, which is actually why Vlad worked on the Windows detection script in the first place.

Jon