base/frameworks/intel/main.bro
-
Intel
The intelligence framework provides a way to store and query IP addresses,
and strings (with a str_type). Metadata can
also be associated with the intelligence, like for making more informed
decisions about matching and handling of intelligence.
Detailed Interface
Types
-
Intel::Info
Type: | record
- ts: time &log
Timestamp when the data was discovered.
- uid: string &log &optional
If a connection was associated with this intelligence hit,
this is the uid for the connection
- id: conn_id &log &optional
If a connection was associated with this intelligence hit,
this is the conn_id for the connection.
- fuid: string &log &optional
If a file was associated with this intelligence hit,
this is the uid for the file.
- file_mime_type: string &log &optional
A mime type if the intelligence hit is related to a file.
If the $f field is provided this will be automatically filled
out.
- file_desc: string &log &optional
Frequently files can be “described” to give a bit more context.
If the $f field is provided this field will be automatically
filled out.
- seen: Intel::Seen &log
Where the data was seen.
- sources: set [string] &log &default = set() &optional
Sources which supplied data that resulted in this match.
|
Record used for the logging framework representing a positive
hit within the intelligence framework.
-
Intel::Item
Type: | record
- indicator: string
The intelligence indicator.
- indicator_type: Intel::Type
The type of data that the indicator field represents.
- meta: Intel::MetaData
Metadata for the item. Typically represents more deeply
descriptive data for a piece of intelligence.
|
Represents a piece of intelligence.
-
Intel::MetaData
-
Data about an Intel::Item.
-
Intel::Seen
-
-
Intel::Type
Type: | enum
-
Intel::ADDR
An IP address.
-
Intel::URL
A complete URL without the prefix "http://".
-
Intel::SOFTWARE
Software name.
-
Intel::EMAIL
Email address.
-
Intel::DOMAIN
DNS domain name.
-
Intel::USER_NAME
A user name.
-
Intel::FILE_HASH
File hash which is non-hash type specific. It’s up to the
user to query for any relevant hash types.
-
Intel::FILE_NAME
File name. Typically with protocols with definite
indications of a file name.
-
Intel::CERT_HASH
Certificate SHA-1 hash.
|
Enum type to represent various types of intelligence data.
-
Intel::Where
-
Enum to represent where data came from when it was discovered.
The convention is to prefix the name with IN_.
Events
-
Intel::log_intel
-
-
Intel::match
-
Event to represent a match in the intelligence data from data that
was seen. On clusters there is no assurance as to where this event
will be generated so do not assume that arbitrary global state beyond
the given data will be available.
This is the primary mechanism where a user will take actions based on
data within the intelligence framework.
Functions
-
Intel::insert
-
Intelligence data manipulation functions.
-
Intel::seen
-
Function to declare discovery of a piece of data in order to check
it against known intelligence for matches.