fireeye / brocapi Goto Github PK

Give users the option to send the PCAPs that get saved to the job folders to an S3 bucket, with a S3 structure following the same format as local disk.
S3 is super cheap for long term storage and could help users access the PCAPs in a larger AWS based analysis environment.

Same as last ticket, I'll gladly write the PR for this.

Add an API endpoint to search and return Bro results by job UUID.

Idea I had is using something simple like TinyDB to store any job UUID as the db's primary key and the bro log path in path key or similar. A user could hit /search/<job_uuid> and get back the zipped logs from the job_logs_bro path or an JSON API error message if the job isn't found.

I started a test of this TinyDB and it works pretty OK for a quick starter. Expanding the TinyDB use further a tiny bit, adding an API route for /jobs/count (for example) and returning the number of all jobs analyzed would be trivial.

Is this something desired I can put in a PR for?

My idea was to expand the config file to give options for sending messages to either: syslog, local JSON output, or HTTP endpoints.
HTTP endpoints could let users feed the results into Splunk, IntelMQ, etc.
JSON is just generally useful...

I forked this already to add this and a few other things but if it's something you'd like in the main repo, I'll submit a PR. I already started writing this in my fork anyhow.