grigorescu

##! Analyzes the Finger protocol

module Finger;

export {
        redef enum Log::ID += { LOG };
      
        ## The record type which contains the column fields of the DHCP log.
        type Info: record {
                ## The earliest time a finger request or response was seen.

grigorescu

# Calculates metrics on March Madness video streaming, including 
# unique IPs, total HTTP requests, and total bytes downloaded.
# Sample output:
#
# fields	ts	ts_delta	app	uniq_hosts	hits	bytes
# types	time	interval	string	count	count	count
# 1395331457.824587	900.000000	march-madness	4	569	164589761
# 1395332324.854514	900.000000	march-madness	17	1917	704801124

@load misc/app-stats

grigorescu

@load base/utils/exec

module Blackhole;

export {
	redef enum Log::ID += { LOG };

	type Info: record {
		## The time at which the query was observed
		ts:            time               &log;

grigorescu

# From: https://bitbucket.org/birkenfeld/pygments-main/src/863c453b293e2db0d63b52d517d4ca994725e364/pygments/lexers/dsls.py?at=default

class BroLexer(RegexLexer):
    """
    For `Bro <http://bro-ids.org/>`_ scripts.

    .. versionadded:: 1.5
    """
    name = 'Bro'
    aliases = ['bro']

grigorescu

@load base/frameworks/files

module ExtractHTTP;

## This module extracts file seen over HTTP, according to a flexible redef-able policy.                                                                                                                                                                                         

export {
       type Policy: record {
                ## MIME types to extract                                                                                                                                                                                                                         
                mime_types:  set[string] &optional;

grigorescu

##! Add support for X-Requested-With                                                                                                                                                                                                                                           
@load base/protocols/http
@load base/frameworks/software
@load policy/protocols/http/software-browser-plugins

module HTTP;

export {
        redef record HTTP::Info += {
                ## X-REQUESTED_WITH value, if set                                                                                                                                                                                                                               

grigorescu

#!/usr/bin/env python2
##
## This script takes a line from the dpd.log generated with the
## policy/frameworks/dpd/packet-segment-logging.bro script, and
## outputs a PCAP to stdout
##
##    Vlad Grigorescu
##    [email protected]
##

grigorescu

Keybase proof

I hereby claim:

• I am grigorescu on github.
• I am vladg (https://keybase.io/vladg) on keybase.
• I have a public key whose fingerprint is BE8A E1D9 A108 4DBC 1BF0 28F6 C115 8FAB 632E 5272

To claim this, I am signing this object:

grigorescu

##! Core script support for logging syslog messages.  This script represents 
##! one syslog message as one logged record.
##!
##! Note: This was slightly simplified for demo purposes

@load ./consts

module Syslog;

export {

grigorescu

@load base/utils/site

event bro_init()
        {
        # First remove the default filter.
        Log::remove_default_filter(HTTP::LOG);
        
        # Add the filter to direct logs to the appropriate file name.
        Log::add_filter(HTTP::LOG, [$name = "http-directions",
                                    $path_func(id: Log::ID, path: string, rec: HTTP::Info) = {