@menu * Starting Bro :: * Bro Scripts :: * Sending (E-mail) Bro Reports :: * Reading a Bro Report :: @end menu @node Starting Bro @section Starting Bro @cindex starting Bro @cindex bro.rc Bro is automatically started at boot time via the @command{bro.rc} script, ( located in /usr/local/bro/etc and /usr/local/etc/rc.d on FreeBSD or /usr/init.d on Linux ) To run this script by hand, type: @example bro.rc start @end example or @example bro.rc checkpoint @end example or @example bro.rc stop @end example Use @code{checkpoint} to restart Bro, loading a new policy file. To get feel for what Bro logs will look like on your traffic, do the following: Generate some "offline" data to play with: @example # tcpdump -s 0 -w trace.out @end example Kill off the tcpdump after capturing traffic for a few minutes (use ctrl-C), then to run Bro against this captured trace file: @example # setenv BROHOME /usr/local/bro # setenv BROPATH $BROHOME/site:$BROHOME/policy # bro -r trace.out hostname.bro @end example @node Bro Scripts @section Bro Scripts @cindex bro_generate_report @cindex bro_log_compress @cindex check_disk @cindex managing disk space Installing Bro automatically creates the following @command{cron} jobs, which are automatically run on a specified interval. @itemize @item @command{site-report.pl}: generates an email report of all alarms and alerts @item @command{mail_reports.sh}: send email reports @end itemize These scripts can also all be run by hand at any time. Bro log files can get quick large, and it is important to make sure that the Bro disk does not fill up. Bro includes some simple scripts to help manage disk space. Most sites will want to customize these for their own requirements, and integrate them into their backup system to make sure files are not removed before they are archived. @itemize @item @command{check_disk.sh}: check for low disk space, and send email @item @command{bro_log_compress.sh}: removes/compresses old log files @end itemize These scripts can be customized by editing their settings in @code{$BROHOME/etc/bro.cfg}. The settings are as follows: @itemize @item @command{check_disk.sh}: @itemize @item @command{diskspace_pct}: when disk is >= this percent full, send email @item @command{diskspace_watcher}: list of email addresses to send mail to @end itemize @end itemize @itemize @item @command{bro_log_compress.sh}: @itemize @item @command{Days2deletion}: remove files more than this many days old (default = 60) @item @command{Days2compression}: compress files more than this many days old (default = 30) @end itemize @end itemize @node Sending (E-mail) Bro Reports @section Sending (E-mail) Bro Reports @cindex e-mail reports @cindex internal report @cindex external report A daily 'internal' report is created that covers three sets of information: @itemize @item Incident information @item Operational status of Bro @item General network traffic information @end itemize If the local organization is asked to report incidents to another incident analysis organization (i.e. CERT, CIAC, FedCIRC, etc.) an auxiliary 'external' report can be created that only contains the incident information. These reports are stored in $BRODIR/reports. The two reports will be mailed to the e-mail addresses specified during Bro installation. These e-mail addresses can be changed by re-running the bro_config script or by editing $BROHOME/etc/bro.cfg directly. Each report has it's own set of e-mail addresses. If it is desired to send the auxiliary report directly to the external incident analysis organization without inspection, enter their e-mail address directly. Otherwise, have the external e-mail sent to someone who can inspect and forward it appropriately. @node Reading a Bro Report @section Reading a Bro Report @cindex incident @cindex incident type @cindex report period @cindex alarm @cindex connection, successful @cindex connection, unsuccessful @cindex connection, history @cindex scans @cindex system statistics @cindex traffic statistics The report is divided into three parts, the summary, incidents, and scans. The summary includes a rollup of incident information, Bro operational statistics, and network information. The incidents section has details for each Bro alarm. The scans section gives details about scans that Bro detected. @subsection Parts of a Report @subsubheading Summary @quotation @strong{Report Period:} The beginning and ending date/times that define the window of network data used to produce the report. @*@* @strong{Incident Count:} The number of each type of incident that are detailed in the report period @*@* @strong{System Statistics:} Operating system statistics that give some idea of the 'health' of Bro's operation. @*@* @strong{Traffic Statistics:} Statistics gathered by Bro that may or may not have significant value in evaluating intrusions, but are useful in understanding the network environment. @end quotation @subsubheading Incidents @quotation @strong{Incident:} Each incident generated by the Bro installation is assigned a unique identification number. This number is unique for all incidents, not just to the daily report. @*@* @strong{Incident Type:} Bro can detect attacks, but cannot make a definitive judgment if an attack is successful without further investigation and/or knowledge of the unique network environment. Bro uses an expert knowledge algorithm to make a determination if an incident is 'Likely Successful', 'Unknown' (not enough information to make a guess), or 'Likely Unsuccessful'. @*@* @strong{Local Host:} The local computer involved in the incident; usually the victim. @*@* @strong{Remote Host:} The remote computer involved in the incident; usually the attacker. @*@* @strong{Alarm(s}:) The network event(s) that Bro detected and identified as probable attacks. @*@* @strong{Successful Connections:} Connections where one host initiates a network request and the other host participates in the subsequent requested transactions. @*@* @strong{Unsuccessful Connections:} Connections where one host initiates a network request and the other host refuses the request. @*@* @strong{Unknown Connections:} Connections where one host initiated a network request, but it is unclear if the other host participated in a successful transaction. @*@* @strong{Connections History:} A summary tabulation of successful and unsuccessful connections made in specific time periods. The tabulations are accumulative. That is, the connections counted under 3 days will also be counted in each subsequent column. @end quotation @subsubheading Scans Scans are repetitive (similar) probes, searching several victim hosts for vulnerabilities. The scan section gives the attack host instigating the scan, the date/time of the scan, and the ports that were probed. @subsection Example Report: @example @verbatim Bro Report Organization Name ========================================================================= Summary July 28, 2004 17:01 to July 29, 2004 17:00 ========================================================================= Incident Likely Successful 1 Summary Unknown 0 Likely Unsuccessful 0 Scans 10 System Bro disk space: <% at time of report generation> Statistics Bro Process cpu: