BroAPT-Core Framework¶
The BroAPT-Core framework is the extraction framework for the BroAPT system. For more information about the framework, please refer to previous documentation at BroAPT-Core Extration Framework.
Bro Scripts¶
Python Modules¶
- Module Entry
- System Entrypoint
- Bro Script Composer
- Common Constants
- Bro Log Parser
- Dataclasses
- Field Parsers
logparser.set_separator
logparser.empty_field
logparser.unset_field
logparser.set_parser()
logparser.vector_parser()
logparser.str_parser()
logparser.port_parser()
logparser.int_parser()
logparser.count_parser()
logparser.addr_parser()
logparser.subnet_parser()
logparser.time_parser()
logparser.float_parser()
logparser.interval_parser()
logparser.enum_parser()
logparser.bool_parser()
logparser.type_parser
- Log Parsers
- Module Entry
- Extraction Process
- Bro Logs Processing
- Auxiliaries & Utilities
- Site Customisations
Wrapper Scripts¶
For the Docker container, we have created some Shell/Bash wrapper scripts to make the life a little bit better.
Bundled Implementation¶
- File location:
source/client/init.sh
#!/usr/bin/env bash
set -aex
# change curdir
cd /broapt
# load environs
if [ -f .env ] ; then
source .env
fi
# compose Bro scripts
/usr/bin/python3.6 python/compose.py
# run scripts
/usr/bin/python3.6 python $@
# sleep
sleep infinity
Cluster Implementation¶
- File location:
cluster/core/source/init.sh
#!/usr/bin/env bash
set -aex
# change cwd
cd /source
# load environs
if [ -f .env ] ; then
source .env
fi
# compose Bro scripts
/usr/bin/python3.6 python/compose.py
# run scripts
/usr/bin/python3.6 python $@
# sleep
sleep infinity