BroAPT-Core Framework¶
The BroAPT-Core framework is the extraction framework for the BroAPT system. For more information about the framework, please refer to previous documentation at BroAPT-Core Extration Framework.
Bro Scripts¶
Python Modules¶
- Module Entry
- System Entrypoint
- Bro Script Composer
- Common Constants
- Bro Log Parser
- Dataclasses
- Field Parsers
logparser.set_separatorlogparser.empty_fieldlogparser.unset_fieldlogparser.set_parser()logparser.vector_parser()logparser.str_parser()logparser.port_parser()logparser.int_parser()logparser.count_parser()logparser.addr_parser()logparser.subnet_parser()logparser.time_parser()logparser.float_parser()logparser.interval_parser()logparser.enum_parser()logparser.bool_parser()logparser.type_parser
- Log Parsers
- Module Entry
- Extraction Process
- Bro Logs Processing
- Auxiliaries & Utilities
- Site Customisations
Wrapper Scripts¶
For the Docker container, we have created some Shell/Bash wrapper scripts to make the life a little bit better.
Bundled Implementation¶
- File location:
source/client/init.sh
#!/usr/bin/env bash
set -aex
# change curdir
cd /broapt
# load environs
if [ -f .env ] ; then
source .env
fi
# compose Bro scripts
/usr/bin/python3.6 python/compose.py
# run scripts
/usr/bin/python3.6 python $@
# sleep
sleep infinity
Cluster Implementation¶
- File location:
cluster/core/source/init.sh
#!/usr/bin/env bash
set -aex
# change cwd
cd /source
# load environs
if [ -f .env ] ; then
source .env
fi
# compose Bro scripts
/usr/bin/python3.6 python/compose.py
# run scripts
/usr/bin/python3.6 python $@
# sleep
sleep infinity