zeek/doc/frameworks/logging-input-sqlite.rst

============================================
Logging To and Reading From SQLite Databases
============================================

.. rst-class:: opening

   Starting with version 2.2, Bro features a SQLite logging writer
   as well as a SQLite input reader. SQLite is a simple, file-based,
   widely used SQL database system. Using SQLite allows Bro to write
   and access data in a format that is easy to use in interchange with
   other applications. Due to the transactional nature of SQLite,
   databases can be used by several applications simultaneously. Hence,
   they can, for example, be used to make data that changes regularly available
   to Bro on a continuing basis.

.. contents::

Warning
=======

In contrast to the ASCII reader and writer, the SQLite plugins have not yet
seen extensive use in production environments. While we are not aware
of any issues with them, we urge to caution when using them
in production environments. There could be lingering issues which only occur
when the plugins are used with high amounts of data or in high-load environments.

Logging Data into SQLite Databases
==================================

Logging support for SQLite is available in all Bro installations starting with
version 2.2. There is no need to load any additional scripts or for any compile-time
configurations.

Sending data from existing logging streams to SQLite is rather straightforward. You
have to define a filter which specifies SQLite as the writer.

The following example code adds SQLite as a filter for the connection log:

.. btest-include:: ${DOC_ROOT}/frameworks/sqlite-conn-filter.bro

.. btest:: sqlite-conn-filter-check

    # Make sure this parses correctly at least.
    @TEST-EXEC: bro ${DOC_ROOT}/frameworks/sqlite-conn-filter.bro

Bro will create the database file ``/var/db/conn.sqlite``, if it does not already exist.
It will also create a table with the name ``conn`` (if it does not exist) and start
appending connection information to the table.

At the moment, SQLite databases are not rotated the same way ASCII log-files are. You
have to take care to create them in an adequate location.

If you examine the resulting SQLite database, the schema will contain the same fields
that are present in the ASCII log files::

    # sqlite3 /var/db/conn.sqlite

    SQLite version 3.8.0.2 2013-09-03 17:11:13
    Enter ".help" for instructions
    Enter SQL statements terminated with a ";"
    sqlite> .schema
    CREATE TABLE conn (
    'ts' double precision,
    'uid' text,
    'id.orig_h' text,
    'id.orig_p' integer,
    ...

Note that the ASCII ``conn.log`` will still be created. To prevent this file
from being created, you can remove the default filter:

.. code:: bro

    Log::remove_filter(Conn::LOG, "default");


To create a custom SQLite log file, you have to create a new log stream that contains
just the information you want to commit to the database. Please refer to the
:ref:`framework-logging` documentation on how to create custom log streams.

Reading Data from SQLite Databases
==================================

Like logging support, support for reading data from SQLite databases is built into Bro starting
with version 2.2.

Just as with the text-based input readers (please refer to the :ref:`framework-input`
documentation for them and for basic information on how to use the input-framework), the SQLite reader
can be used to read data - in this case the result of SQL queries - into tables or into events.

Reading Data into Tables
------------------------

To read data from a SQLite database, we first have to provide Bro with the information, how
the resulting data will be structured. For this example, we expect that we have a SQLite database,
which contains host IP addresses and the user accounts that are allowed to log into a specific
machine.

The SQLite commands to create the schema are as follows::

    create table machines_to_users (
    host text unique not null,
    users text not null);

    insert into machines_to_users values ('192.168.17.1', 'bernhard,matthias,seth');
    insert into machines_to_users values ('192.168.17.2', 'bernhard');
    insert into machines_to_users values ('192.168.17.3', 'seth,matthias');

After creating a file called ``hosts.sqlite`` with this content, we can read the resulting table
into Bro:

.. btest-include:: ${DOC_ROOT}/frameworks/sqlite-read-table.bro

.. btest:: sqlite-read-table-check

    # Make sure this parses correctly at least.
    @TEST-EXEC: bro ${DOC_ROOT}/frameworks/sqlite-read-table.bro

Afterwards, that table can be used to check logins into hosts against the available
userlist.

Turning Data into Events
------------------------

The second mode is to use the SQLite reader to output the input data as events. Typically there
are two reasons to do this. First, when the structure of the input data is too complicated
for a direct table import. In this case, the data can be read into an event which can then
create the necessary data structures in Bro in scriptland.

The second reason is, that the dataset is too big to hold it in memory. In this case, the checks
can be performed on-demand, when Bro encounters a situation where it needs additional information.

An example for this would be an internal huge database with malware hashes. Live database queries
could be used to check the sporadically happening downloads against the database.

The SQLite commands to create the schema are as follows::

    create table malware_hashes (
    hash text unique not null,
    description text not null);

    insert into malware_hashes values ('86f7e437faa5a7fce15d1ddcb9eaeaea377667b8', 'malware a');
    insert into malware_hashes values ('e9d71f5ee7c92d6dc9e92ffdad17b8bd49418f98', 'malware b');
    insert into malware_hashes values ('84a516841ba77a5b4648de2cd0dfcb30ea46dbb4', 'malware c');
    insert into malware_hashes values ('3c363836cf4e16666669a25da280a1865c2d2874', 'malware d');
    insert into malware_hashes values ('58e6b3a414a1e090dfc6029add0f3555ccba127f', 'malware e');
    insert into malware_hashes values ('4a0a19218e082a343a1b17e5333409af9d98f0f5', 'malware f');
    insert into malware_hashes values ('54fd1711209fb1c0781092374132c66e79e2241b', 'malware g');
    insert into malware_hashes values ('27d5482eebd075de44389774fce28c69f45c8a75', 'malware h');
    insert into malware_hashes values ('73f45106968ff8dc51fba105fa91306af1ff6666', 'ftp-trace');


The following code uses the file-analysis framework to get the sha1 hashes of files that are
transmitted over the network. For each hash, a SQL-query is run against SQLite. If the query
returns with a result, we had a hit against our malware-database and output the matching hash.

.. btest-include:: ${DOC_ROOT}/frameworks/sqlite-read-events.bro

.. btest:: sqlite-read-events-check

    # Make sure this parses correctly at least.
    @TEST-EXEC: bro ${DOC_ROOT}/frameworks/sqlite-read-events.bro

If you run this script against the trace in ``testing/btest/Traces/ftp/ipv4.trace``, you
will get one hit.