search

activecm / rita-legacy

Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
GNU General Public License v3.0
2.51k stars 361 forks source link

Bro to MongoDB Direct Connect Plug In #70

Open Zalgo2462 opened 7 years ago

Zalgo2462 commented 7 years ago

Bro IDS possesses an extensible architecture allowing for new code to be distributed and ran along side it. In particular, it allows plugins to define new log writers. In theory, a plugin to write Bro data to MongoDB directly could be written.

Unfortunately, there isn't great documentation on how to go about doing this.

http://supbrosup.blogspot.com/2014/09/bro-plugins.html describes the process of making a C++ function available to Bro via the plugin system.

https://github.com/0xxon/bro-postgresql is an example of a Bro plugin which writes to an SQL server.

https://github.com/bro/bro/blob/master/src/logging is the source code for the logging plugin framework. It appears to be well documented from a code perspective.

JonZeolla commented 7 years ago

I'm currently working with the bro team to improve this documentation as a part of my efforts to update and improve the bro Kafka writer plugin. I'll provide updates here as I have them.

Zalgo2462 commented 6 years ago

https://github.com/ocmdev/bro-mongodb Work has begun on a Bro to MongoDB plugin. Currently it does not support rolling over databases day by day. Additionally, #150 blocks the use of the plugin.