Writing a Bro script to make an API call?

Zeek
1

Similar to how Bro implements the detect-MHR script, I’d like to do a lookup against a REST API for hashes on executables…I can do it easily enough in python but…How can I do it in Bro?

I copied the detect-MHR as a template, but immedietly ran into the questions of “how do I make an http request with Bro?” and “Will that request now end up in my http.logs?” and “Does Bro have native abilities to deal with JSON objects in a reasonable way?” and “What happens if I’m getting two lines in my response: a csv style line and a JSON “object”?”…

Obviously I have a lot to learn, and would appreciate any resourses I could be point to for doing so… :slight_smile:

Cheers,

Jesse

2

No, not yet. I'm hoping that for 2.2 we can get some form of active HTTP into Bro. I have something implemented in my junk drawer repository already, but it needs a bug fix that hasn't been merged into master yet.

  .Seth

3

Ah, ok…Well, sounds like it’s time for me to try out that external command script you’ve mentioned… :slight_smile:

Cheers,

Jesse

4

The ActiveHTTP module is actually there already too (it wraps the command line curl client). :wink:

It does require the topic/jsiwek/ticket946 branch though and there may be problems with doing lots of HTTP requests or Exec commands at runtime due to some thread clean up issues that still exist.

  .Seth