Quick script to run bro against a pcap capturing

prep-report.sh

#!/usr/bin/env bash

# Tested on Debian 10 (Buster)

# Make a report folder
outdir=bro-`date +%FT%H-%M-%S`
mkdir $outdir

# Generate our reports with bro in the report folder
cd $outdir
bro -r /honeypot-data/rdp*.pcap* -C
cat rdp.log | bro-cut -d ts id.orig_h id.orig_p id.resp_h id.resp_p cookie result security_protocol keyboard_layout client_build client_name > rdp_summary.txt
cd ..

# Archive up our summary data
zip $outdir.zip $outdir/*

# Send an email with the rdp_summary.txt as the body content and the full logs as a zip attachment
YOUR_DOMAIN=
YOUR_SRC_EMAIL=
YOUR_DST_EMAIL=

# Requires mailgun account
curl -s --user 'api:YOUR_API_KEY' \
	 "https://api.mailgun.net/v3/$YOUR_DOMAIN/messages" \
	 -F from='RDP Honeypot <$YOUR_SRC_EMAIL>' \
	 -F to="$YOUR_DST_EMAIL" \
	 -F subject='RDP Daily Report' \
	 -F attachment=@$outdir.zip \
	 -F text="$(cat $outdir/rdp_summary.txt)"
   
# Clean up
rm -rf $outdir $outdir.zip