BRO IDS
ArchivedBRO IDS normalizes BRO IDS events and enables you to analyze BRO IDS data using pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.
Release Details
Package Details
- Dashboard Package
- LP_Bro IDS
- Normalization Package
- LP_BRO IDS
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
Installation
- Download the .pak file from the Download link above.
- Add the required BRO IDS as a device in Logpoint.
- Create a collection policy with the Syslog collector and an appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Log Format
Expected Log Format
BRO IDS
Log Sample
t=1169xxxxx.xxxxx no=PortScan na=NOTICE_ALARM_ALWAYS sa=xxx.xxx.x.xxx sp=12345/tcp da=xxx.xxx.x.xxx dp=123/tcp msg=1.1.1.1\ has\ scanned\ xx\ ports\ of\ xxx.xxx.x.xxx tag=@x
To export data to Logpoint use the Syslog collector on port 514 on the Logpoint server.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.