AbheLink Black or White ?

Showing posts with label bro. Show all posts

New securityonion-web-page package adds ELSA query to show DNS zone transfers

I've updated the securityonion-web-page package to add an ELSA query that will show DNS zone transfers. The updated package version is securityonion-web-page - 20120722-0ubuntu0securityonion18 and it has been tested by the following (thanks!):
Heine Lysemose

Issues Resolved

Issue 487: securityonion-web-page: add DNS zone transfer query
https://code.google.com/p/security-onion/issues/detail?id=487

Screenshots

DNS: Zone Transfers - shows any DNS AXFR requests over TCP

Updating
The new package is now available in our stable repo. Please see the following page for full update instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list:
http://groups.google.com/group/security-onion

We also need help testing new packages:
http://groups.google.com/group/security-onion-testing

Thanks!

Selengkapnya

New securityonion-web-page package adds ELSA query to show connections grouped by node

I've updated the securityonion-web-page package to add an ELSA query that will group connections by node. The updated package version is securityonion-web-page - 20120722-0ubuntu0securityonion15 and it has been tested by the following (thanks!):
JP Bourget

Issues Resolved

Issue 477: ELSA menu should include BRO_CONN groupby:node
https://code.google.com/p/security-onion/issues/detail?id=477

Screenshots

Connections: Grouped by Node - shows how many connections each sensor is seeing

Selengkapnya

New securityonion-web-page package available

I've updated our securityonion-web-page package. The updated package version is securityonion-web-page - 20120722-0ubuntu0securityonion12 and has been tested by David Zawdie.

Issues Resolved

Issue 455: securityonion-web-page: update hyperlink
https://code.google.com/p/security-onion/issues/detail?id=455

Issue 456: securityonion-web-page: add example ELSA queries
https://code.google.com/p/security-onion/issues/detail?id=456

This package adds a new URL (https://your.security.onion.hostname/elsa/) that includes a menu on the left with some common ELSA queries.

Screenshots

Connections: Top SRC IPs - Top Source IP Addresses in Bro's conn.log

Connections: Top DST Ports - Top Destination Ports in Bro's conn.log

Connections: Top Services - Top Services Identified in Bro's conn.log

Connections: Port 53 groupby Service - Top Services Identified on Port 53 in Bro's conn.log

DHCP: Top Assigned IPs - Top Assigned IP Addresses seen in Bro's dhcp.log

DNS: Top Requests - Top DNS Requests seen in Bro's dns.log

DNS: Top nxdomain - Top nxdomain Responses seen in Bro's dns.log

Files: MIME Types - Top MIME Types seen in Bro's files.log

Files: Sources - Top Protocol Sources in Bro's files.log

FTP: Top arg - FTP Transactions in Bro's ftp.log

Host Logs: OSSEC Alerts - HIDS Alerts from OSSEC

Host Logs: All OSSEC Logs - Raw Logs from OSSEC (not HIDS Alerts)

Host Logs: Syslog-NG - Standard Syslog received by Syslog-NG

Host Logs: Syslog Detected by Bro - Syslog detected by Bro and logged to syslog.log

HTTP: Top User Agents - Top HTTP User Agents in Bro's http.log

HTTP: Top Sites - Top HTTP Sites in Bro's http.log

HTTP: Sites hosting EXEs - Sites hosting EXEs in Bro's http.log

Notice: Top Notice Types - Top Notice Types found in Bro's notice.log

SMTP: Top Subjects - Top Email Subject Lines in Bro's smtp.log

Snort/Suricata: Top Snort Alerts - Top IDS Alerts from Snort or Suricata

Sortware: Software Detected by Bro - Top Software Types found in Bro's software.log

Weird: Top Weird Types - Top Traffic Anomalies found in Bro's weird.log

Selengkapnya

New securityonion-bro-scripts package fixes a race condition

A new version of our securityonion-bro-scripts package is now available that fixes a possible race condition.

This update resolves the following issue:
Issue 374: Update hostname.bro and interface.bro

Thanks
Thanks to Jon Siwek for the new Bro scripts!
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie

Upgrading
The new packages are now available in our stable repo. Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart Bro:

sudo broctl restart

Screenshots

Under certain conditions, the old Bro scripts would fail to determine the hostname and interface...

...resulting in Bro's conn.log containing an invalid "sensorname" field (should be hostname-interface)

Installing new securityonion-bro-scripts package

Restarting Bro

Bro now properly determines hostname and interface resulting in...

...conn.log having the correct sensorname (hostname-interface)

Feedback
If you have any questions or problems, please use our mailing list:
https://code.google.com/p/security-onion/wiki/MailingLists

Help Wanted
If you and/or your organization have found value in Security Onion, please consider giving back to the community by joining one of our teams:
https://code.google.com/p/security-onion/wiki/TeamMembers

We especially need help in answering support questions on the mailing list and IRC channel. Thanks!

Selengkapnya

New securityonion-sguil-client and securityonion-sguil-server packages include Bro Transcript functionality

New versions of our securityonion-sguil-client and securityonion-sguil-server packages are now available that add a new "Bro" option to the Sguil client's right-click context menu. This option will run the pcap through a Bro script that will mimic the existing tcpflow transcript option but with a couple of very important changes:

any gzipped server responses are automatically unzipped
transcripts are rendered for not only tcp but also udp traffic

This update resolves the following issue:
Issue 347: New Sguil client transcript option to run through tcpudpflow.bro

Thanks
Thanks to Scott Runnels for his work on the Bro script and changes to the sguil packages!
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie

Upgrading
The new packages are now available in our stable repo. Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart sguild:

sudo nsm_server_ps-restart

Screenshots

Upgrade Process

Restarting sguild

Existing Transcript option

Existing Transcript option doesn't handle gzip encoded server responses

New Bro option

New Bro option unzips any gzip encoded server responses

Selengkapnya

New securityonion-bro-scripts and securityonion-capme packages

A new version of our securityonion-bro-scripts package is now available that extends Bro's conn.log to include the hostname and interface that saw the connection. In addition, a new version of our securityonion-capme package automatically determines if you're pivoting from ELSA and, if so, queries Bro's conn.log via ELSA for the source and destination IP/port. It then parses the hostname/interface out of the result to locate the pcap and render the transcript. The net result of these changes is that pivoting to CapMe from ELSA no longer depends on the prads session data in the Sguil sancp table.

This update resolves the following issue:
Issue 348: Update CapME with a new option to query Bro conn.log via ELSA

Thanks
Thanks to the following for testing the new packages!
Matt Gregory
David Zawdie
Michal Purzynski

Upgrading
The new packages are now available in our stable repo. Please see our Upgrade page for full upgrade instructions:
https://code.google.com/p/security-onion/wiki/Upgrade

After installing the new packages, you'll need to restart Bro: