blacktop / docker-bro Goto Github PK

Hello,
I have two questions:
-First: I want to set the log format into JSON, but when I create the volume with the json-logs.bro file like this
./bro/json/:/opt/bro/scripts/policy/tuning/
It creates that file, but the logs are not in JSON format. It is possible to set that?
https://www.bro.org/sphinx/scripts/policy/tuning/json-logs.bro.html

-Second: Where are the bro config files? broccoli.conf, broctl.cfg, networks.cfg and node.cfg. I want to import my configuration from a working Bro.

Regards,
Joaquín Silva

Any idea why I'm not getting logs indexed in ES?

docker run -d --rm --name elasticsearch -p 80:80 -p 9200:9200 blacktop/elastic-stack:5.6
docker run -it --rm -v /my_path:/pcap --link elasticsearch blacktop/bro:elastic bro-watch

Files are available in /pcap. bro -r test.pcap local only creates .state directory. Kibana is accessible and index is created.

Same thing as issue #3, but suggesting to have "docker run -e" vars to be linked to bro config vars.
For example;
docker run -e use_json=T will set in the bro logger file (your image has it written in /usr/local/share/bro/base/frameworks/logging/writers/ascii.bro) line 27, const use_json = T &redef.

how to install package in docker bro

Hi, I think there might be a problem with the instructions for your bro image with elasticsearch as I can't get el2 the image el2 loaded.....

docker -l debug run -it --rm -v pwd:/pcap --link elasticsearch el2 -r heartbleed.pcap local "Site::local_nets += { 192.168.11.0/24 }"
Unable to find image 'el2:latest' locally
/run/torcx/bin/docker: Error response from daemon: pull access denied for el2, repository does not exist or may require 'docker login'.
See '/run/torcx/bin/docker run --help'.

I tried creating an account at docker.com and using "docker login" but I still get repo errors.

can you help ?

also.... the docker elasticsearch example you provide loads in the hearbleed.pcap file, could you tell me how to alter it to use an interface ethX instead as the input ?

Thanks
Keith.

is there a reason this appears to be intended to work with pcap files only rather than live capture?

Each of the Dockerfiles have the line:

VOLUME ["/pcap"]

However, the README instructs users to use a bind mount to insert pcap files into the container. Additionally, the docker-compose files use bind mounts as well.

VOLUME instructions carry a lot of baggage and tend to get in the way when they aren't needed.

For further reading on the VOLUME statement and why it gets in the way, see
https://boxboat.com/2017/01/23/volumes-and-dockerfiles-dont-mix/

Is there a reason for the VOLUME statement that I am missing?

Hi

I tried to run bro with kafka integration but it comes up with the following error
$docker run --rm -v /home/cyborg/brov:/pcap blacktop/bro:kafka -P -r heartbleed.pcap local "Site::local_nets += { 192.168.11.0/24 }"
fatal error in /usr/local/share/bro/site/local.bro, line 105: can't find Bro/Kafka/logs-to-kafka.bro

I've been trying to run your image to analyse my pcaps and I got some issues

Running as described in the README:

docker run --rm -v <custom_path>:/pcap -v <custom_path>/local.bro:/usr/local/share/bro/site/local.bro blacktop/bro -C -r 100000.pcap local
WARNING: No Site::local_nets have been defined.  It's usually a good idea to define your local networks.
1489729328.697138 warning: can't issue DNS request
1489729360.105610 warning: can't issue DNS request
1489729371.531733 warning: can't issue DNS request
1489729474.622960 warning: can't issue DNS request
1489729492.326755 warning: can't issue DNS request
1489729494.033201 warning: can't issue DNS request
1489729590.499785 warning: can't issue DNS request

docker run --rm -v <custom_path>:/pcap -v <custom_path>/local.bro:/usr/local/share/bro/site/local.bro blacktop/bro -C -r 100000.pcap local "Site::local_nets += { 192.168.11.0/24 }"
1489729328.697138 warning in <params>, line 1: can't issue DNS request
1489729360.105610 warning in <params>, line 1: can't issue DNS request
1489729371.531733 warning in <params>, line 1: can't issue DNS request
1489729474.622960 warning in <params>, line 1: can't issue DNS request
1489729492.326755 warning in <params>, line 1: can't issue DNS request
1489729494.033201 warning in <params>, line 1: can't issue DNS request
1489729590.499785 warning in <params>, line 1: can't issue DNS request

I've tried with 192.168.11.0/24, 127.0.0.11/24, 127.0.0.11/16, 172.17.0.1/16

And

docker run --rm -v <custom_path>:/pcap -v <custom_path>/local.bro:/usr/local/share/bro/site/local.bro blacktop/bro -C -r 100000.pcap"
# returns nothing, even the notice file is missing

The pcap file has malicious traffic.

Testing DNS with another image:

docker run -it --rm busybox sh -c 'cat /etc/resolv.conf && echo && nslookup google.com'
nameserver 8.8.8.8
nameserver 8.8.4.4

Server:    8.8.8.8
Address 1: 8.8.8.8 google-public-dns-a.google.com

Name:      google.com
Address 1: 2800:3f0:4001:80d::200e
Address 2: 216.58.202.110 gru06s10-in-f110.1e100.net

Can you help me to fix it?

i got error when i run as follow:
"root@localhost:/home/xuwei/bro_workpalce/test4# docker run --rm
-v pwd:/pcap
--link kafka:localhost
blacktop/bro:kafka -P -r heartbleed.pcap local "Site::local_nets += { 192.168.11.0/24 }"
Unable to find image 'blacktop/bro:kafka' locally
kafka: Pulling from blacktop/bro
5d20c808ce19: Pulling fs layer
477dbbea3083: Pulling fs layer
af8fbe84de2b: Pulling fs layer
5e9fb904e5fb: Waiting
c7d677aba90d: Waiting
b156ec96e1bf: Waiting
docker: error pulling image configuration: received unexpected HTTP status: 500 Internal Server Error."

how to solve this

Hi, could you please help to fix the issues with file permitions?
if i run as root the offered command:
#docker run --rm -it --cap-add=NET_RAW --net=host -v pwd:/pcap:rw blacktop/bro -i ens160
if have the following:

[root@cbtlinux bro]# docker logs bro
listening on ens160
error: packet_filter/Log::WRITER_ASCII: cannot open packet_filter.log: Permission denied
error: packet_filter/Log::WRITER_ASCII: terminating thread
error: reporter/Log::WRITER_ASCII: cannot open reporter.log: Permission denied
error: reporter/Log::WRITER_ASCII: terminating thread
1512745949.920468 error: weird/Log::WRITER_ASCII: cannot open weird.log: Permission denied
1512745949.920468 error: weird/Log::WRITER_ASCII: terminating thread
1512745950.385030 error: dns/Log::WRITER_ASCII: cannot open dns.log: Permission denied
1512745950.385030 error: dns/Log::WRITER_ASCII: terminating thread
1512745950.408958 error: files/Log::WRITER_ASCII: cannot open files.log: Permission denied
1512745950.408958 error: files/Log::WRITER_ASCII: terminating thread
1512745950.408958 error: http/Log::WRITER_ASCII: cannot open http.log: Permission denied
1512745950.408958 error: http/Log::WRITER_ASCII: terminating thread
1512745950.555018 error: x509/Log::WRITER_ASCII: cannot open x509.log: Permission denied
1512745950.555018 error: x509/Log::WRITER_ASCII: terminating thread
1512745950.623345 error: tunnel/Log::WRITER_ASCII: cannot open tunnel.log: Permission denied
1512745950.623345 error: tunnel/Log::WRITER_ASCII: terminating thread

...
and so on. 

what is the problem?

moreover i did "chmod a+rw" for the host directory which binds to /pcap

GeoLite link is dead.

There is an option to switch to GeoLite2, but It requires a newer bro version (2.6.x)

On https://hub.docker.com/r/blacktop/bro/ in the Getting Started section the second command reads
wget https://github.com/blacktop/docker-bro/blob/master/scripts/local.bro
which does download the github site and not the local.bro. You probably want something like
wget https://raw.githubusercontent.com/blacktop/docker-bro/master/scripts/local.bro