aggregate.meta

[0xxon/bro-sumstats-counttable]
description = Two-dimensional buckets for sumstats (count occurences per $str).
tags = sumstats, summary statistics
test_command = cd tests && btest -d
url = https://github.com/0xxon/bro-sumstats-counttable
version = 0.0.3

[0xxon/bro-postgresql]
build_command = ( ./configure --bro-dist=%(bro_dist)s --with-postgresql-inc=`pg_config --includedir` --with-postgresql-server-inc=`pg_config --includedir-server`  --with-postgresql-lib=`pg_config --libdir` && make )
description = A PostgreSQL reader and writer for Bro.
plugin_dir = build
tags = bro plugin, PostgreSQL, reader, writer, input
test_command = cd tests && btest -d
version = 0.0.6
url = https://github.com/0xxon/bro-postgresql

[0xxon/bro-plugin-roca]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Identify certificates potentially affected by CVE-2017-15361
plugin_dir = build/Johanna_ROCA.tgz
tags = certificates, CVE-2017-15361
test_command = cd tests && btest -d
url = https://github.com/0xxon/bro-plugin-roca
version = 0.0.1

[activecm/bro-mongodb.git]
build_command = (./configure --bro-dist=%(bro_dist)s && make)
description = Bro IDS/ MongoDB connector.
tags = bro plugin, MongoDB, writer, security, conn, logging, rita
version = master
url = https://github.com/activecm/bro-mongodb.git

[activecm/bro-rita.git]
build_command = (./configure --bro-dist=%(bro_dist)s && make)
description = RITA, Bro IDS connector.
tags = bro plugin, MongoDB, writer, security, conn, logging, rita
version = master
url = https://github.com/activecm/bro-rita.git

[apache/metron-bro-plugin-kafka]
build_command = ./configure --bro-dist=%(bro_dist)s --with-librdkafka=%(LIBRDKAFKA_ROOT)s && make
config_files = scripts/init.bro
depends = 
	bro >=2.5.0
	bro-pkg >=1.2
description = A Bro log writer plugin that sends logging output to Kafka.
external_depends = 
	librdkafka ~0.9.4
plugin_dir = build
script_dir = build/scripts/Apache/Kafka
tags = log writer, bro plugin, kafka
test_command = ( cd tests && btest -d )
user_vars = 
	LIBRDKAFKA_ROOT [/usr/local/lib] "Path to librdkafka installation tree"
version = 0.1
url = https://github.com/apache/metron-bro-plugin-kafka

[bro/bro-netmap]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Packet source plugin that provides native Netmap support.
plugin_dir = build
tags = packet source, plugin, netmap
test_command = ( cd tests && btest -d )
url = https://github.com/bro/bro-netmap
version = master

[corelight/bro-long-connections]
description = Find and log long-lived connections into a "conn_long" log.
script_dir = scripts
tags = conn
version = master
url = https://github.com/corelight/bro-long-connections

[corelight/bro-xor-exe-plugin]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = A plugin to find Windows executables that have been XOR encoded.
plugin_dir = build
tags = plugin, pe, executable, malware
test_command = ( cd tests && btest -d )
url = https://github.com/corelight/bro-xor-exe-plugin
version = master

[corelight/bro-hardware]
description = Scripts for cases where hardware device identifiers are discovered.
script_dir = scripts
tags = hardware
version = master
url = https://github.com/corelight/bro-hardware

[corelight/bro-drwatson]
depends = 
	https://github.com/corelight/bro-hardware *
description = Discover and log information discovered in Microsoft DrWatson messages.
script_dir = scripts
tags = drwatson, http, windows
test_command = ( cd tests && btest -d )
url = https://github.com/corelight/bro-drwatson
version = master

[corelight/bro-shellshock]
description = Discover successful ShellShock attacks.
script_dir = scripts
tags = shellshock, detect, scripts
test_command = ( cd tests && btest -d )
url = https://github.com/corelight/bro-shellshock
version = master

[corelight/conn-burst]
description = Identify bursty connections (large and fast)
script_dir = scripts
tags = conn, burst
url = https://github.com/corelight/conn-burst
version = master

[corelight/log-add-http-post-bodies]
description = Add a POST body excerpt into the HTTP log
script_dir = scripts
tags = http log extend
version = master
url = https://github.com/corelight/log-add-http-post-bodies

[corelight/log-add-vlan-everywhere]
description = Add VLAN to all Bro logs.
script_dir = scripts
tags = log extend vlan
version = master
url = https://github.com/corelight/log-add-vlan-everywhere

[corelight/top-dns]
depends = 
	bro/sethhall/domain-tld *
description = Log the top DNS queries being requested.
script_dir = scripts
tags = dns, sumstats, log, measurement, top
url = https://github.com/corelight/top-dns
version = master

[corelight/bro-community-id]
build_command = ./configure --bro-dist=%(bro_dist)s && make
description = "Community ID" flow hash support in conn.log
script_dir = scripts/Corelight/CommunityID
tags = bro plugin, conn, logging, community id, flow hashing, flow id, sha1, corelight
test_command = cd tests && btest -d community-id
url = https://github.com/corelight/bro-community-id
version = 1.0

[corelight/json-streaming-logs]
description = JSON streaming logs
script_dir = scripts
tags = logs, json, streaming, stream, filebeat, splunk_forwarder, logstash
url = https://github.com/corelight/json-streaming-logs
version = master

[corelight/http-stalling-detector]
description = Detect HTTP stalling attacks like slowloris.
script_dir = scripts
tags = http, DoS, attack, notice
url = https://github.com/corelight/http-stalling-detector
version = master

[corelight/bro-quic]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Detects the Google QUIC (GQUIC) protocol and adds "gquic"
	to conn.log's "service" field.
plugin_dir = build/Corelight_GQUIC.tgz
script_dir = build/scripts/Corelight/GQUIC
tags = plugin, analyzer, gquic, quic
url = https://github.com/corelight/bro-quic
version = master

[dopheide/bro_notice_correlation]
description = Adds support for multi-notice correlation. For more information, see http://blog.samoehlert.com/correlating-bro-notices or the talk from BroCon 2016.
script_dir = scripts
tags = notices, notice, correlation
version = master
url = https://github.com/dopheide/bro_notice_correlation

[dopheide/venom]
description = Attempts to detect an attacker calling to the VENOM Linux Rootkit https://security.web.cern.ch/security/venom.shtml
script_dir = scripts
tags = Venom, venom, VENOM, rootkit
version = master
url = https://github.com/dopheide/venom

[dopheide/bro-quic]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Attempt to identify QUIC protocol
plugin_dir = build/Bro_QUIC.tgz
tags = plugin, analyzer, quic
url = https://github.com/dopheide-esnet/bro-quic
version = 0.1

[dovehawk/dovehawk]
description = MISP+Bro. Dovehawk is a Bro Module to import MISP indicators to the Intel Framework automatically and report sightings directly back to MISP as they happen.
script_dir = .
tags = intel, MISP, sightings, signatures
version = master
url = https://github.com/tylabs/dovehawk

[endace/bro-dag]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Packet source plugin that provides native support for Endace DAG capture cards.
plugin_dir = build
tags = packet source, plugin, broctl plugin, dag, endace
test_command = ( cd tests && btest -d )
url = https://github.com/endace/bro-dag
version = v0.2.0

[fatemabw/bro-inventory-scripts]
description = Find different type of OSes and AV software in your network traffic.
script_dir = scripts
tags = OS detection, Anti-Virus
version = master
url = https://github.com/fatemabw/bro-inventory-scripts

[hhzzk/dns-tunnels]
description = Detect DNS Tunnels attack.
script_dir = scripts
tags = DNS, DNS Tunnels, DNS Tunneling
version = master
url = https://github.com/hhzzk/dns-tunnels

[hosom/file-extraction]
config_files = scripts/config.bro
depends = 
	bro >=2.5.0
description = Extract files from network traffic with Bro.
script_dir = scripts
tags = files, file extraction, file analysis
version = master
url = https://github.com/hosom/file-extraction

[hosom/log-filters]
config_files = scripts/config.bro
depends = 
	bro >=2.5.0
description = Implement common log filters.
script_dir = scripts
tags = logging, log framework
version = master
url = https://github.com/hosom/log-filters

[hosom/bro-napatech]
build_command = (./configure --bro-dist=%(bro_dist)s && make)
depends = 
	bro-pkg >=1.2
	bro >=2.5.0
description = Packet source plugin that provides native support for NTAPI
plugin_dir = build/Bro_Napatech.tgz
tags = packet source, plugin, napatech, ntapi
url = https://github.com/hosom/bro-napatech
version = 0.1.0

[initconf/scan-NG]
description = scan detection in 2.x world. Forward porting of bro-1.5.3 scan.bro accompanied with new heuristics and quicker detections
script_dir = scripts
tags = scan detection
version = master
url = https://github.com/initconf/scan-NG

[initconf/CVE-2017-5638_struts]
description = package to detect CVE-2017-5638 struts attack
script_dir = scripts
tags = CVE-2017-5638, struts
version = master
url = https://github.com/initconf/CVE-2017-5638_struts

[initconf/phish-analysis]
description = Suite of smtp related policies includes extracting and logging URLs from emails and various smtp anomaly detection heuristics to help flag phishing emails
script_dir = scripts
tags = smtp, phish, urls, emails
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/phish-analysis

[initconf/smtp-url-analysis]
description = Suite of smtp related policies includes extracting and logging URLs from emails and various smtp anomaly detection heuristics to help flag phishing emails
script_dir = scripts
tags = smtp, phish, urls, emails
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/smtp-url-analysis

[initconf/blacklist]
description = package to manage blacklisted IP address ysing bro
script_dir = scripts
tags = blacklist
version = master
url = https://github.com/initconf/blacklist

[initconf/vnc-scanner]
description = Simple policy to detect VNC (RFB) scanners based on src->dst connection counts
script_dir = scripts
tags = rfb, vnc, osx high sierra
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/vnc-scanner

[initconf/ftp-bruteforce]
description = ftp-bruteforce
script_dir = scripts
tags = ftp, bruteforce, scan
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/initconf/ftp-bruteforce

[irtimmer/bro-xdp_packet-plugin]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends = 
	bro-pkg >=1.2
	bro >=2.5.0
description = This plugin provides native AF_XDP support for Bro.
plugin_dir = build/itimmer_af_xdp.tgz
tags = bro plugin, packet source, af_xdp
test_command = cd tests && btest -d
url = https://github.com/irtimmer/bro-xdp_packet-plugin
version = master

[j-gras/intel-extensions]
description = Extensions for Bro's intelligence framework.
script_dir = scripts
tags = intel, expiration, removal, preserve files
url = https://github.com/J-Gras/intel-extensions
version = v0.3.0

[j-gras/add-json]
description = Additional JSON-logging for Bro.
script_dir = scripts
tags = log, logging, JSON
url = https://github.com/J-Gras/add-json
version = 1.1.0

[j-gras/add-node-names]
depends = 
	bro >=2.5
description = Adds cluster node name to logs.
script_dir = scripts
tags = log, logging, conn, add node name, add worker
url = https://github.com/J-Gras/add-node-names
version = master

[j-gras/intel-seen-more]
description = Additional seen-triggers for Bro's intelligence framework.
script_dir = scripts
suggests = 
	bro/sethhall/domain-tld *
tags = intel, seen
url = https://github.com/J-Gras/intel-seen-more
version = 0.3.0

[j-gras/bro-af_packet-plugin]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends = 
	bro-pkg >=1.2
	bro >=2.5.0
description = This plugin provides native AF_Packet support for Bro.
plugin_dir = build/Bro_AF_Packet.tgz
tags = bro plugin, broctl plugin, packet source, af_packet
test_command = cd tests && btest -d
url = https://github.com/J-Gras/bro-af_packet-plugin
version = 1.3.0

[j-gras/bro-lognorm]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends = 
	bro >=2.5.0
description = This plugin provides liblognorm integration for Bro.
plugin_dir = build
tags = bro plugin, liblognorm, syslog
test_command = cd tests && btest -d
url = https://github.com/J-Gras/bro-lognorm
version = 0.3.0

[joesecurity/Joe-Sandbox-Bro]
description = JoeSandbox-Bro extracts files from your internet connection
	and analyzes them automatically on Joe Sandbox. Combined with Joe Sandbox's
	reporting and alerting features you can build a powerful IDS.
script_dir = scripts
tags = file analysis, sandbox, malware, virus
url = https://github.com/joesecurity/Joe-Sandbox-Bro
version = master

[jonzeolla/scan-sampling]
description = Modified version of scan.bro to add destination IP sampling.
script_dir = scripts
tags = sumstats
url = https://github.com/JonZeolla/scan-sampling
version = 0.1.0

[jsiwek/bro-test-package]
build_command = cd plugin && ./configure --bro-dist=%(bro_dist)s && make
description = An example Bro package for testing purposes.
plugin_dir = plugin/build
script_dir = plugin/scripts/Demo/Rot13
tags = example, test, bro plugin, broctl plugin, rot13, cipher
test_command = cd testing && btest -d tests
url = https://github.com/jsiwek/bro-test-package
version = 1.0.5

[jsiwek/bro_bitcoin]
description = Detects Bitcoin, Litecoin, or other cryptocurrency
	mining traffic that uses getwork, getblocktemplate, or Stratum mining
	protocols over TCP or HTTP.
tags = signatures, bitcoin, mining, cryptocurrency
url = https://github.com/jsiwek/bro_bitcoin
version = master

[jswaro/tcprs]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = TCP Retransmission and State Analyzer plugin for Bro.
plugin_dir = build
script_dir = scripts
tags = bro plugin, TCP, retransmission, connection state, conn, input reader, protocol analyzer
test_command = cd tests btest -d tcprs
url = https://github.com/jswaro/tcprs
version = 0.2.1

[klehigh/find_smbv1]
depends = 
	bro >=2.5.0
description = find SMBv1 activity
script_dir = scripts
tags = smb, logging
url = https://github.com/klehigh/find_smbv1
version = 1.0.0

[mitrecnd/bro-http2]
build_command = ./configure --bro-dist=%(bro_dist)s && make
depends = 
	bro >=2.5.0
description = A HTTP2 protocol analyzer for the Bro IDS.
external_depends = 
	libnghttp2>=1.11.0
	libbrotlidec>=1.0.0
script_dir = scripts
tags = bro plugin, protocol analyzer, http2, intel
test_command = make test
url = https://github.com/MITRECND/bro-http2
version = 0.4.0

[ncsa/bro-interface-setup]
description = A broctl plugin that helps you setup capture interfaces
plugin_dir = .
tags = bro plugin, interface, mtu
url = https://github.com/ncsa/bro-interface-setup
version = master

[ncsa/bro-doctor]
description = A broctl plugin that helps you troubleshoot common problems
	For cluster-related checks, the package "add-node-names" is recommended.
plugin_dir = .
suggests = 
	bro/j-gras/add-node-names *
tags = broctl plugin, troubleshoot
url = https://github.com/ncsa/bro-doctor
version = 1.21.3

[ncsa/bro-is-darknet]
description = This plugin adds a Site::is_darknet function.
	This is useful for scripts that track scan attempts or other probes.
	It can handle purely dark address space as well as honeynet space.
script_dir = scripts
tags = bro plugin, site, darknet
test_command = (cd testing && btest -d)
url = https://github.com/ncsa/bro-is-darknet
version = 0.4

[ncsa/bro-simple-scan]
depends = 
	bro >=2.5.1
	bro/ncsa/bro-is-darknet >=0.3
description = Simple, high performance tcp scan detection
script_dir = scripts
tags = bro plugin, scan detection
test_command = (cd testing && btest -d)
url = https://github.com/ncsa/bro-simple-scan
version = 1.1

[ncsa/bro-zeromq-writer]
build_command = ./configure --bro-dist=%(bro_dist)s --with-zmq=%(ZEROMQ_PREFIX)s && make
description = ZeroMQ log writer.
external_depends = 
	zeromq >=3.2.0
script_dir = scripts/NCSA/ZeroMQWriter
tags = bro plugin, log writer, zeromq, zmq, 0mq, json
test_command = make test
user_vars = 
	ZEROMQ_PREFIX [/usr/local] "ZeroMQ install prefix"
url = https://github.com/ncsa/bro-zeromq-writer
version = master

[ntop/bro-pf_ring]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
description = Packet source plugin that provides native PF_RING support.
plugin_dir = build
script_dir = scripts
tags = packet source, plugin, pf_ring
test_command = ( cd tests && btest -d )
url = https://github.com/ntop/bro-pf_ring
version = master

[pgaulon/bro-notice-slack]
description = Bro Notices through Slack webhook
tags = bro plugin, notices, slack webhook
url = https://github.com/pgaulon/bro-notice-slack
version = 1.0.0

[reservoirlabs/fix-ascii]
build_command = ./configure --bro-dist=%(bro_dist)s && make
description = ASCII FIX analyzer package
script_dir = scripts/RLABS/FIX/
tags = bro plugin, bro analyzer, ASCII FIX protocol analyzer
url = https://github.com/reservoirlabs/fix-ascii
version = master

[reservoirlabs/fix-binary]
build_command = ./configure --bro-dist=%(bro_dist)s && make
description = binary FIX analyzer package
script_dir = scripts/RLABS/FIX_SBE
tags = bro plugin, bro analyzer, binary FIX protocol analyzer
url = https://github.com/reservoirlabs/fix-binary
version = master

[salesforce/ja3]
description = JA3 creates 32 character SSL client fingerprints and logs them as a field in ssl.log. These fingerprints can easily be shared as threat intelligence or used as correlation items for enhanced alerting and analysis. This package also adds JA3 to the Bro Intel Framework.
	https://github.com/salesforce/ja3
script_dir = bro
tags = intel, ssl, logging
version = master
url = https://github.com/salesforce/ja3

[salesforce/hassh]
description = HASSH is used to identify specific Client and Server SSH implementations. The fingerprints can be stored, searched and shared in the form of an MD5 fingerprint. This package logs components to ssh.log
script_dir = bro
tags = bro plugin, ssh, fingerprint, logging
version = master
url = https://github.com/salesforce/hassh

[scebro/ldap-analyzer]
build_command = ./configure --bro-dist=%(bro_dist)s && make
description = LDAP write operations analyzer for Bro.
plugin_dir = build
scripts_dir = scripts
tags = bro plugin, ldap analyzer, ldap
test_command = cd tests && btest -d
version = master
url = https://github.com/SoftwareConsultingEmporium/ldap-analyzer

[sethhall/credit-card-exposure]
description = Detect credit card numbers in HTTP and SMTP with Bro.
script_dir = scripts
tags = credit cards, dlp, http, smtp, files
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/sethhall/credit-card-exposure

[sethhall/ssn-exposure]
description = Detect US Social Security numbers in HTTP and SMTP with Bro.
script_dir = scripts
tags = ssn, social security number, dlp, files
version = master
url = https://github.com/sethhall/ssn-exposure

[sethhall/domain-tld]
description = A library for getting the "effective tld" of a domain name.
script_dir = scripts
tags = library, domain
version = master
url = https://github.com/sethhall/domain-tld

[sethhall/bro-myricom]
build_command = ( ./configure --bro-dist=%(bro_dist)s && make )
depends = 
	bro-pkg >=1.2
description = Packet source plugin that provides native Myricom SNF v3+v4 support.
plugin_dir = build/Bro_Myricom.tgz
script_dir = scripts.not_used
tags = packet source, plugin, myricom
test_command = ( cd tests && btest -d )
url = https://github.com/sethhall/bro-myricom
version = 1.0.4

[sethhall/unknown-mime-type-discovery]
description = A Bro package for finding new file signatures.
script_dir = scripts
tags = files, signature
url = https://github.com/sethhall/unknown-mime-type-discovery
version = master

[srozb/dns_axfr]
description = Find and notice DNS zone transfer attempts.
script_dir = scripts
tags = dns recon
version = master
url = https://github.com/srozb/dns_axfr

[srozb/http_csp]
description = HTTP Content-Security-Policy report parser
script_dir = scripts
tags = CSP intel
url = https://github.com/srozb/http_csp
version = 1.0.0

[tenzir/bro-vast]
depends = 
	bro >= 2.6-beta2-14
description = A package that enables Bro to communicate with VAST
script_dir = scripts
tags = vast, intel
url = https://github.com/tenzir/bro-vast
version = master

[theflakes/bro-large_uploads]
description = Raise notices on outgoing files over X bytes in size.
	Also raise notices for multiple large outgoing Tx's in Y time frame.
tags = notices, uploads, conns
url = https://github.com/theflakes/bro-large_uploads
version = master

[vitalyrepin/uap-bro]
build_command = ./configure --bro-dist=%(bro_dist)s  && make
config_files = build/scripts/init.bro
depends = 
	bro >=2.5.0
	bro-pkg >=1.2
description = User Agent Parser - Bro implementation based on uap-core
external_depends = 
	libyaml-cpp-dev ~0.5.2
	libboost-regex-dev ~1.58.0
plugin_dir = build
script_dir = build/scripts/VR/UAP
tags = bro plugin, uap, user_agent
test_command = ( cd tests && btest -d )
version = master
url = https://github.com/vitalyrepin/uap-bro