Next: Signatures, Previous: Customizing Builtin Policy, Up: Customizing Bro
For example, if your site only allows external http and mail to a small, controlled lists of hosts, you could write a new .bro file containing this:
const web_servers = { www.lbl.gov, www.bro-ids.org, }; const mail_servers = { smtp.lbl.gov, smtp2.lbl.gov, }; const allow_my_services: set[addr, port] = { [mail_servers, smtp], [web_servers, http], };
Bro can then generate an Alarm or even terminate the connection for policy violations. For example:
event connection_established(c: connection) { local id = c$id; local service = id$resp_p; local inbound = is_local_addr(id$resp_h); if ( inbound && [id$resp_h, service] !in allow_my_services ) NOTICE ([$note=SensitiveConnection, $conn=c, $msg=fmt("hot: %s", full_id_string(c)) ]); if ( inbound && service in terminate_successful_inbound_service ) terminate_connection(c); }
To test this you might do the following. First, generate some "offline" data to play with:
# tcpdump -s 0 -w trace.out port smtp or port http
Kill off the tcpdump after capturing traffic for a few minutes (use ctrl-C). Then add the above Bro code to your hostname.bro file, and run Bro against this captured trace file:
# setenv BROHOME /usr/local/bro # setenv BROPATH $BROHOME/site:$BROHOME/policy # bro -r trace.out hostname.bro