JustinAzoff

module TerminateConnection;

export {
	redef enum Notice::Type += {
		TerminatingConnection,	# connection will be terminated
		TerminatingConnectionIgnored,	# connection terminated disabled
	};

	# Whether we're allowed (and/or are capable) to terminate connections
	# using "rst".

JustinAzoff

redef exit_only_after_terminate = T;

event test()
	{
    local src = 1.2.3.4;
    local dst = 8.8.8.8;
    local output = "";
	if ( T )
		{
		when ( local src_name = lookup_addr(src) )

JustinAzoff

#!/usr/bin/env python

import difflib
import sys
import tarfile

def read(fn):
    with open(fn) as f:
        return f.readlines()

JustinAzoff

/*
   american fuzzy lop - postprocessor library example
   --------------------------------------------------

   Written and maintained by Michal Zalewski <lcamtuf@google.com>

   Copyright 2015 Google Inc. All rights reserved.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.

JustinAzoff

@load base/protocols/http
@load base/protocols/ssh

event connection_established(c: connection)
{
    statsd_increment("bro.connection.established", 1);
}

event connection_rejected(c: connection)
{

JustinAzoff

module RDP;

export {
	redef enum Notice::Type += {
		BruteforceScan, 
	}; 

	global rdp_scanners_account = /[a-zA-Z]/ &redef ; 
	redef rdp_scanners_account +=   /NCRACK_USER/ ; 

JustinAzoff

#!/usr/bin/env python
import os
import sys
import time

DEFAULT_LOG = "/usr/local/bro/logs/current/conn.log"

def config():
    print """
graph_category network

JustinAzoff

ver = 2.4.1

all: package

source: bro-$(ver).tar.gz
unpack: bro-$(ver)

deps: deps-stamp

deps-stamp:

JustinAzoff

#!/usr/bin/env python
import re
import sys

regexes = [
        "img.*jpg",
        "baz.*etc",
]

compiled = [(r, re.compile(r)) for r in regexes]

JustinAzoff

#!/usr/bin/env python
import sys
import re
from collections import defaultdict

totals = defaultdict(int)
host_dropped = {}

total_rx = total_drop = 0