SO 16.04 Bro intel.dat not working anymore

336 views
Skip to first unread message

Christian Sommer

unread,
Jun 25, 2018, 4:57:44 AM6/25/18
to security-onion
Hi,

we recentyl switched to SO 16.04 and noticed, that Bro doesn't produce an intel.log anymore.
The intel.dat is fine (same file working perfectly on some boxes still on SO 14.04)
The reporter.log is empty. Also sostat isn't showing any problems.

Any idea how to fix this?

BR
Chris

Wes Lambert

unread,
Jun 26, 2018, 7:42:24 AM6/26/18
to securit...@googlegroups.com
Hi Christian,

Have you checked to see if the Bro Intel framework scripts are loaded?

grep -i intel /nsm/bro/logs/current/loaded_scripts.log

Thanks,
Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.


--

Christian Sommer

unread,
Jun 27, 2018, 2:34:32 AM6/27/18
to security-onion
Hi Wes,

yes the __load__.bro in in the loaded_scripts.log and contains the path to the intel.dat

grep -i intel /nsm/bro/logs/current/loaded_scripts.log
{"name":" /opt/bro/share/bro/base/frameworks/intel/__load__.bro"}
{"name":" /opt/bro/share/bro/base/frameworks/intel/main.bro"}
{"name":" /opt/bro/share/bro/base/frameworks/intel/files.bro"}
{"name":" /opt/bro/share/bro/base/frameworks/intel/cluster.bro"}
{"name":" /opt/bro/share/bro/base/frameworks/intel/input.bro"}
{"name":" /opt/bro/share/bro/intel/__load__.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/__load__.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/conn-established.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/where-locations.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/dns.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/file-hashes.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/file-names.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/http-headers.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/http-url.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/pubkey-hashes.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/ssl.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/smtp.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/smtp-url-extraction.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/seen/x509.bro"}
{"name":" /opt/bro/share/bro/policy/frameworks/intel/do_notice.bro"}


cat /opt/bro/share/bro/intel/__load__.bro
@load frameworks/intel/seen
@load frameworks/intel/do_notice
@load frameworks/files/hash-all-files

redef Intel::read_files += {
"/opt/bro/share/bro/intel/intel.dat"
};

Erwin

unread,
Jul 3, 2018, 4:53:01 AM7/3/18
to security-onion
Hi Wes,


do you have any idea why it´s not working?


Regards,
Erwin

Wes Lambert

unread,
Jul 3, 2018, 1:52:23 PM7/3/18
to securit...@googlegroups.com
I would try restarting Bro and checking reporter.log again.  Another test would be to include intel for Google.com and to curl the domain, as mentioned here: https://github.com/Security-Onion-Solutions/security-onion/wiki/Alienvault-OTX#installation

Thanks,
Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

Erwin

unread,
Jul 5, 2018, 7:39:24 AM7/5/18
to security-onion
Hi Wes,

we do now get a intel.log - so far so good.
But the more important thing is: we do not have any BRO Alert in Squert.


We checked Sguil DB, we dont have any entry for BRO/Intel/Notice in MySQL.
But there are IDS entrys.

Netsniff-NG Config seems ok we can see the source "intel" is ok.
Bro Agent is also working.


Could there be a Permission Problem as there is now a randomized password for the MySQL?

thanks,
Erwin

Wes Lambert

unread,
Jul 5, 2018, 3:18:38 PM7/5/18
to securit...@googlegroups.com
Erwin,

Are you referring to this Bro agent?


By default, we do not enable or configure a Bro agent for Sguil.    

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

Erwin

unread,
Jul 5, 2018, 4:45:35 PM7/5/18
to security-onion
Wes,


yes is there something changed in 16.04 from 14.04, it could broke it?

We do not see a Intel Log in ELK aswell something is going on here.
Is it possible we do have a mysql issue here as it was changed to a random password?


thank you,
Erwin

Wes Lambert

unread,
Jul 6, 2018, 8:20:08 AM7/6/18
to securit...@googlegroups.com
Hi Erwin,

This is likely because we switched to JSON logging for Bro and the Bro agent is written to depend on tab-separated values.  You can try switching back to TSV by following the steps here:


Please keep in mind we don't officially support the Bro agent, but hopefully the above will help.

Thanks,
Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

Erwin

unread,
Jul 7, 2018, 2:48:26 PM7/7/18
to security-onion
Hi Wes,


thank you for the support, we will check this, and get back to you.


Regards,
Erwin

Erwin

unread,
Jul 9, 2018, 2:17:56 PM7/9/18
to security-onion
Hi Wes,


right now we rewrite the code of the bro agent to run with json again, we will see if it works ;)

Anyway, we have the problem the intel.log is empty and does not catch the interessting stuff out in there.
We tested with curl xxx.xyz whateever domain.

any clue why do not see any intel.log?
LOG is Empty from LS/EL, no clues in there...

Thanks,
Erwin

Wes Lambert

unread,
Jul 10, 2018, 9:24:36 AM7/10/18
to securit...@googlegroups.com
Any clues in a new(er) reporter.log?

Have you tried adding the following in intel.dat?

google.com[literal tab]Intel::DOMAIN[literal tab]Test-Google-Intel[literal tab]https://google.com[literal tab]T

Then curling google.com?


Then checking intel.log?  

grep google /nsm/bro/logs/current/intel.log

Is Bro running okay?

sudo so-bro-status

Thanks,
Wes

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
To post to this group, send email to securit...@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.
Reply all
Reply to author
Forward
0 new messages