Skip to content

Instantly share code, notes, and snippets.

@mpurzynski
mpurzynski / bro-otx-py3.py
Created March 8, 2019 19:21
bro-otx-py3.py
#!/usr/bin/env python
import requests
import sys
import os
from argparse import ArgumentParser
from configparser import ConfigParser
from datetime import datetime, timedelta
from urllib.parse import urlparse
@mpurzynski
mpurzynski / build.log
Created March 15, 2019 19:38
build.log
Mock Version: 1.2.14
ENTER do(['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --target x86_64 --nodeps /builddir/build/SPECS/bro-af-packet.spec'], chrootPath='/var/lib/mock/clear-bro-af-packet/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'LANG': 'en_US.UTF-8', 'CCACHE_DIR': '/var/tmp/ccache', 'CCACHE_UMASK': '002'}shell=Falselogger=<mockbuild.trace_decorator.getLog object at 0x7fd1f19af358>timeout=0uid=1000gid=1000user='mockbuild'printOutput=False)
Executing command: ['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --target x86_64 --nodeps /builddir/build/SPECS/bro-af-packet.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'LANG': 'en_US.UTF-8', 'CCACHE_DIR': '/var/tmp/ccache', 'CCACHE_UMASK': '002'} and shell False
Building target platforms: x86_64
Building for target x86_64
Wrote: /builddir/build/SRPMS/bro-af-packet-1.4.0-1.src.rpm
Ch
@mpurzynski
mpurzynski / cmake_args
Created March 19, 2019 00:40
cmake_args
-DBinPAC_ROOT_DIR=`bro-config --binpac_root` -DBROKER_ROOT_DIR=`bro-config --broker_root` -DCAF_ROOT_DIR=`bro-config --caf_root` -DBRO_CONFIG_PLUGIN_DIR=`bro-config --plugin_dir` -DBRO_CONFIG_PREFIX=`bro-config --prefix` -DBRO_CONFIG_INCLUDE_DIR=`bro-config --include_dir` -DBRO_CONFIG_CMAKE_DIR=`bro-config --cmake_dir` -DCMAKE_MODULE_PATH=`bro-config --cmake_dir` -DKERNELHEADERS_ROOT_DIR=/usr/lib/modules/$(uname -r)/build
@mpurzynski
mpurzynski / buildreq_add
Last active March 19, 2019 00:56
Autospec files for the Bro AF_Packet plugin
# This file contains additional build requirements that did not get
# picked up automatically. One name per line, no whitespace.
bro
bro-abi
bro-bin
bro-lib
bro-plugins
bro-dev
linux-dev
@mpurzynski
mpurzynski / lookupmac.py
Created March 21, 2019 01:57
lookup mac addresses in the oui database
ouifilename = "oui.txt"
with open(ouifilename) as ouifile:
macassignments = {}
for i in ouifile.readlines()[0::]:
i = i.strip()
if "(hex)" in i:
fields = i.split("\t")
macprefix = fields[0][0:8].replace("-", ":").lower()
entity = fields[2]
macassignments[macprefix] = entity
@load base/frameworks/intel
@load frameworks/intel/seen
module Intel;
export {
# const default_per_item_expiration = 5 min &redef;
const default_per_item_expiration = 300 &redef;
redef record MetaData += {
expire: double &default=default_per_item_expiration;
@mpurzynski
mpurzynski / add_hash_to_ssl_log.bro
Created April 2, 2019 20:11
add_hash_to_ssl_log.bro
@load base/protocols/ssl
module SSL;
redef record Info += {
server_cert_md5: string &log &optional;
client_cert_md5: string &log &optional;
server_cert_sha1: string &log &optional;
client_cert_sha1: string &log &optional;
};
@mpurzynski
mpurzynski / otx-misp.py
Created April 16, 2019 17:44
otx-misp.py
---
otx_api_key: {{ otx_api_key }}
misp_api_key: {{ misp_api_key }}
misp_api_url: {{ misp_api_url }}
<IfModule !mod_php5.c>
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
DirectoryIndex /index.php index.php
<FilesMatch \.php$>
SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>
</IfModule>
@load frameworks/intel/seen
module Intel;
#fields indicator indicator_type meta.source meta.desc meta.url meta.uuid meta.do_notice meta.expire
export {
redef record MetaData += {
uuid: string &optional;
};