dcode

ROCK Sensor Parts List

Below is the hardware I use for development and home use of my ROCK sensor. It’s an extremely powerful system in a small form factor, under $1000. The most important aspects to me were that I wanted IPMI for baremetal remote management, dual Intel NICs, quiet, and relatively low-power. I sit by this thing and work everyday and don’t want to wear hearing protection while I write code.

The prices reflect what I paid for them in March 2016. No doubt the prices will have changed and newer, better stuff is probably available. Things like RAM and SSDs go on sale all the time, so look for that if you’re a bargain shopper.

Sensor Hardware

Case

Antec ISK 300-150 Black Mini-ITX Desktop Computer Case 150 Watt Power Supply - $70.70

RAM

https://www.amazon.com/gp/product/B015YPB1NK/ref=oh_aui_detailpage_o04_s00?ie=UTF8&psc=1[CRUCIAL TECHNOLOGY 16GBx2 32GB Kit, DDR4 2133 MT/s DIMM 288 (CT2K16G4D

dcode

redef Site::local_nets += { 10.0.0.0/24, 192.168.11.0/24 };
global share_exe_IPs: addr_set;

event smtp_data (c: connection, is_orig: bool, data:string)
{
    for (line in find_all(data, /.*\\\\.*\\.*\.exe/))
    {
        local temp = split_string(line,/\\/);
        local IP = to_addr(temp[2]);
        if ( ! is_local(IP) )

dcode

# requirements.txt.orig is the result of `pip freeze > requirements.txt.orig`
# requirements.txt is the current snapshot of pipe
comm -2 -3 requirements.txt requirements.txt.orig | awk -F= '{ print $1 }' | xargs pip uninstall -y

dcode

diff -u --recursive bro-2.5.orig/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake bro-2.5/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake
--- bro-2.5.orig/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake	2017-05-26 03:15:47.598844347 +0000
+++ bro-2.5/aux/plugins/af_packet/cmake/FindKernelHeaders.cmake	2017-05-26 03:21:44.099990030 +0000
@@ -20,10 +20,18 @@
   OUTPUT_STRIP_TRAILING_WHITESPACE
 )
 
+# Admittedly a hack, but in practice we just need *some* headers
+execute_process(
+  COMMAND bash "-c" "find /usr/src/kernels -print |  grep -E '/include/linux/user.h' | cut -d/ -f5 | sort -u | tail -1"

dcode

#!/bin/bash
# 75-dual-home-routing
# Description: Updates routing tables to allow traffic on dual-homed boxes
# according to the interface it came in on
# Place in /etc/NetworkManager/dispatcher.d/ and update interface name below

IF=$1
STATUS=$2

function update_routing_table() {

dcode

ROCK NSM Beta 0 Notes

dcode

# -*- mode: ruby -*-
# vi: set ft=ruby :

Vagrant.configure("2") do |config|
  config.vm.box = "bento/centos-7.2"

  config.vm.provider "vmware_fusion" do |vmware|
    vmware.linked_clone = true
    #vmware.gui = true
    vmware.vmx["memsize"] = "8192"

dcode

NAME := bro

GIT_REPO   := https://github.com/bro/bro.git
GIT_BRANCH := master
COMMIT0    := $(shell git ls-remote $(GIT_REPO) | grep -E 'refs/heads/$(GIT_BRANCH)$$' | cut -f1)
SHORTCOMMIT0 := $(shell echo $(COMMIT0)| awk '{ print substr($$0, 1, 7)}')

VERSION ?=$(shell cat VERSION | cut -d- -f1)
RELEASE ?=$(shell cat VERSION | cut -d- --complement -f1 | tr -d '-')
SNAPSHOT := .git$(SHORTCOMMIT0)

dcode

## Setup Kafka output
@load Bro/Kafka/logs-to-kafka.bro

redef Kafka::topic_name = "bro";
redef Kafka::json_timestamps = JSON::TS_ISO8601;
redef Kafka::tag_json = T;

## Setup event extension to include sensor and probe name
type Extension: record {
    ## The name of the system that wrote this log. This

dcode

                                              ┌─────────────┐  ┌─────────────┐ ┌─────────────┐                                          
                                              │             │  │             │ │             │                                          
                                              │ Master Node │  │ Master Node │ │ Master Node │                                          
                                              │             │  │             │ │             │                                          
                                              └─────────────┘  └─────────────┘ └─────────────┘                                          
                                                                                                                                        
                                                              node.master: true                                                         
┌─────────────┐                                               nod