hosom / bro-otx

Integrate Zeek with Alienvault OTX

bro-otx

Integrate Bro with Alienvault OTX

Installation

Unzip the project into your equivalent to /opt/bro/share/bro/site/

Add the following to your local.bro: @load site/otx

Add your api key to the bro-otx.conf configuration file.

Add the bro-otx.py script into the crontab of a user with the ability to write to your bro scripts directories.

bro-otx's Issues

Issue getting bro to load OTX plugin

Hello,

I have installed BRO-OTX as suggested but there is no intel.log file and also in /usr/local/bro/logs/current/loaded_scripts.log there is no record of otx, Am I doing something wrong?

I have installed bro-otx into /usr/local/bro/share/bro/policy/bro-otx and in load.bro I have @load bro-otx

I have ran /usr/local/bro/bin/broctl check and get no errors about otx (and when I make the path wrong it gives me an error).

Im sure its simple, if you can point me in the right direction that would be great!

Daniel

Intel::URL entries need protocol removed

In OTX, URLs are listed including the protocol scheme (http:// ftp:// etc). The Intel::URL indicator type (seen.indicator_type) in bro-otx fails to trigger if the scheme exists.

Example: if otx.dat has an Intel::URL entry "http://example.com/path.txt" Bro will not react. However, if the otx.dat entry is simply "example.com/path.txt", Bro triggers as expected.

Is it possible for bro-otx to strip the protocol scheme from Intel::URL types?

Sources lists only OTX user

Would it be possible to include more info about the OTX pulse in the Sources field?

Currently when using this Bro script when I have an intel hit from OTX it only lists (what I think) is the OTX username that the indicator came from in the Sources field.

I was previously using the AlienVault Bro IDS Connector (https://github.com/AlienVault-Labs/OTX-Apps-Bro-IDS) but switched to this as it seemed like a better implementation. Using the AlienVault Bro IDS Connector the source in Bro's intel log was listed as "AlienVault OTX - [Pulse name] - [Pulse id]"

configuration file not configurable

Need to make the configuration file location configurable by the user

Error messages from Bro

 0.000000        Reporter::ERROR /opt/bro/share/bro/site/otx/otx.dat/Input::READER_ASCII: could not read first line   (empty)

Seems to be caused by writing the file in place. Should be an easy fix to write it under a temporary name and then move it to the proper name.