Giter Site home page Giter Site logo

sethhall / bro-lognorm Goto Github PK

View Code? Open in Web Editor NEW

This project forked from j-gras/zeek-lognorm

0.0 2.0 0.0 35 KB

Bro plugin providing liblognorm integration.

License: BSD 3-Clause "New" or "Revised" License

CMake 19.05% Makefile 3.18% Shell 4.72% Zeek 41.95% C++ 31.10%

bro-lognorm's Introduction

Bro::Lognorm

This plugin aims at integrating liblognorm into Bro and is under development.

Installation

The plugin is based on liblognorm, which requires libfastjson. Make sure both libraries are available including their headers, which are required to build this plugin.

Bro Package Manager

The plugin is available as package for the Bro Package Manager and can be installed using the following command:

bro-pkg install bro-lognorm

To install uncompiled plugins, Bro's source code must be available to the package manager (see package manager's documentation for more information).

Manual Install

The following will compile and install the Lognorm plugin alongside Bro, assuming it can find the headers in a standard location:

# ./configure && make && make install

If the headers are installed somewhere non-standard, add --with-liblognorm=<liblognorm-header-directory> respectively --with-libfastjson=<libfastjson-header-directory> to the configure command. If everything built and installed correctly, you should see this:

# bro -N Bro::Lognorm
    Bro::Lognorm - Log file analyzing (in development) (dynamic, version 0.3)

Usage

The plugin wraps basic liblognorm functionality by providing the lognorm opaque type. This type allows to parse log lines based on liblognorm rule files. In case a rule matches, an event for every tag the rule defines is scheduled. To handle these, one needs to define an event with the corresponding name. This event may specify any subset of fields, parsed by the rule, as arguments. Fields are mapped to arguments by name.

The plugin comes with a small set of scripts that allow easy integration. For more details see scripts/Bro/Lognorm/.

Notes

  • The plugin is not well tested!
  • Variables are implicitly converted into Bro types. Currently only string, int, double and bool are supported.
  • In particular, the plugin does not support nested types (might be implemented on demand).
  • The unparsed_line() event cannot be used in cluster mode.
  • If you have any ideas or suggestions, feel free to reach out!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.