Re: UPDATE: Bro/Zeek ATT&CK-based Analytics and Reporting (BZAR), by MITRE
"Weasel, Gary W CIV DISA RE (US)" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <0C34D9CA9B9DBB45B1C51871C177B4B291C30B18@UMECHPA68.easf.csd.disa.mil> |
Mark, Thank you for the update! Confirming on my end that we're able to get it running and producing notices. v/r Gary -----Original Message----- From: Fernandez, Mark I <[email protected]> Sent: Wednesday, April 10, 2019 12:39 PM To: [email protected]; Weasel, Gary W CIV DISA RE (US) <[email protected]> Subject: [Non-DoD Source] UPDATE: Bro/Zeek ATT&CK-based Analytics and Reporting (BZAR), by MITRE All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. ________________________________ Gary, All - We updated the BZAR scripts to be forward-compatible with Zeek v2.6.x and backward-compatible with v2.5.x and below, using '@if' directives to check the version number. Affected files include: main.bro, bzar_dce-rpc.bro, and bzar_smb.bro. Please visit the GitHub repo to find the updates files. * Caution-https://github.com/mitre-attack/car/tree/master/implementations/bzar < Caution-https://github.com/mitre-attack/car/tree/master/implementations/bzar > Cheers, Mark Mark I. Fernandez The MITRE Corporation [email protected] < Caution-mailto:[email protected] > P.S. The Bro/Zeek Package Manager for BZAR is coming soon. _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek