Re: Ryu Controller
Richard Bejtlich <[email protected]> Tue, 26 Nov 2019 17:20:23 -0500
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAOtSMjb89d-FwFijNvbOuG8pn35e_n7+ySoAGkq=u12zUczAnw@mail.gmail.com> |
--===============0090752335== Content-Type: multipart/alternative; boundary="000000000000f9a13b0598474905" --000000000000f9a13b0598474905 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Why are you interested in this approach? Is it a school project? Zeek isn=E2=80=99t designed to be an intrusion detection system that create= s alerts, although it does produce notices. You might be better off with Suricata if you want alerts. Sincerely, Richard On Tue, Nov 26, 2019 at 4:17 PM Priyatham Ganta <[email protected]> wrote: > Hi, > > I'm trying to run Bro as IDS. Hence, I don't want to show all the logs on > the console.I just want to look at the alerts generated by Bro if there a= re > any attacks on the network. That's the reason I want to print only the > alerts and not logs. > How do I run Bro in IDS mode? > > For Bro to run as IDS, there should be some policies configured with whic= h > this application will differentiate between normal traffic and malicious > traffic. I want to look at those policies. > > Can you help me with this? > > Thanks > > On Tue, 26 Nov 2019 at 10:54, Johanna Amann <[email protected]> wrote: > >> Hi, >> >> > How can I run bro for the current traffic and show the alerts on a >> > console >> > instead of logs? >> >> you can run it on the command line without using zeekctl/broctl using >> zeek (or bro) -i [interfacename]. However, logs will always written to >> files - it does not really make sense to write them to the console, >> which would make it hard to distinguish between the different log >> streams. >> >> Note - most Zeek logs are policy neutral and not really alerts=E2=80=A6 >> >> > Also where can I check the policies that are configured to Bro for >> > IDS? >> >> I don=E2=80=99t 100% get the questions. If you load misc/loaded-scripts = in >> your configuration, you will get a loaded-scripts.log which will show >> you all script files that are loaded. The default configuration of Zeek >> loads most protocol analyzers and writes their log-files. >> >> > Also what is the difference between the broctl binary and bro binary? >> >> zeekctl/broctl is the management application to start zeek cluster >> setups. See e.g. https://github.com/zeek/zeekctl - or >> https://docs.zeek.org/en/stable/quickstart/ for a getting started guide >> that mentions this. >> >> Johanna >> > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --=20 Richard Bejtlich Principal Security Strategist, Corelight https://corelight.blog/author/richardbejtlich/ --000000000000f9a13b0598474905 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div><div dir=3D"auto">Why are you interested in this approach? Is it a sch= ool project?=C2=A0</div><div dir=3D"auto"><br></div><div dir=3D"auto">Zeek = isn=E2=80=99t designed to be an intrusion detection system that creates ale= rts, although it does produce notices. You might be better off with Suricat= a if you want alerts.</div></div><div dir=3D"auto"><br></div><div dir=3D"au= to">Sincerely,</div><div dir=3D"auto"><br></div><div dir=3D"auto">Richard= =C2=A0</div><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"g= mail_attr">On Tue, Nov 26, 2019 at 4:17 PM Priyatham Ganta <<a href=3D"m= ailto:[email protected]">[email protected]</a>> wrote:<br></= div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef= t:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">Hi,<div><br><div>I'= m trying to run Bro as IDS. Hence, I don't want to show all the logs on= the console.I just want to look at the alerts generated by Bro if there ar= e any attacks on the network. That's the reason I want to print only th= e alerts and not logs.</div><div>How do I run Bro in IDS mode?</div><div><b= r></div><div>For Bro to run as IDS, there should be some policies configure= d with which this application will differentiate between normal traffic and= malicious traffic. I want to look at those policies.</div></div><div><br><= /div><div>Can you help me with this?</div><div><br></div><div>Thanks</div><= /div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">O= n Tue, 26 Nov 2019 at 10:54, Johanna Amann <<a href=3D"mailto:johanna@ic= ir.org" target=3D"_blank">[email protected]</a>> wrote:<br></div><blockqu= ote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px= solid rgb(204,204,204);padding-left:1ex">Hi,<br> <br> > How can I run bro for the current traffic and show the alerts on a <br= > > console<br> > instead of logs?<br> <br> you can run it on the command line without using zeekctl/broctl using <br> zeek (or bro) -i [interfacename]. However, logs will always written to <br> files - it does not really make sense to write them to the console, <br> which would make it hard to distinguish between the different log <br> streams.<br> <br> Note - most Zeek logs are policy neutral and not really alerts=E2=80=A6<br> <br> > Also where can I check the policies that are configured to Bro for <br= > > IDS?<br> <br> I don=E2=80=99t 100% get the questions. If you load misc/loaded-scripts in = <br> your configuration, you will get a loaded-scripts.log which will show <br> you all script files that are loaded. The default configuration of Zeek <br= > loads most protocol analyzers and writes their log-files.<br> <br> > Also what is the difference between the broctl binary and bro binary?<= br> <br> zeekctl/broctl is the management application to start zeek cluster <br> setups. See e.g. <a href=3D"https://github.com/zeek/zeekctl" rel=3D"norefer= rer" target=3D"_blank">https://github.com/zeek/zeekctl</a> - or <br> <a href=3D"https://docs.zeek.org/en/stable/quickstart/" rel=3D"noreferrer" = target=3D"_blank">https://docs.zeek.org/en/stable/quickstart/</a> for a get= ting started guide <br> that mentions this.<br> <br> Johanna<br> </blockquote></div> _______________________________________________<br> Zeek mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a><br> <a href=3D"http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek" rel=3D"n= oreferrer" target=3D"_blank">http://mailman.ICSI.Berkeley.EDU/mailman/listi= nfo/zeek</a></blockquote></div></div>-- <br><div dir=3D"ltr" class=3D"gmail= _signature" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div d= ir=3D"ltr"><div><div dir=3D"ltr">Richard Bejtlich<div>Principal Security St= rategist, Corelight</div><div><a href=3D"https://corelight.blog/author/rich= ardbejtlich/" target=3D"_blank">https://corelight.blog/author/richardbejtli= ch/</a><br></div></div></div></div></div></div></div> --000000000000f9a13b0598474905-- --===============0090752335== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0090752335==--