bro-intel-generator

KO | EN

gitlite — search

#hacktoberfest #typescript #golang #rust #docker #macos #cli #kubernetes #vue #security #ios #mcp #openai #open-source

bro-intel-generator

(★ 76)

Script for generating Bro intel files from pdf or html reports

File Explorer

Download Latest Version (.zip)

.gitignore
intel_generator.sh
LICENSE
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

bro-intel-generator
===================

Script for generating Bro intel files from pdf or html reports

# Dependencies

We make use of some additional packages that you have to install

On debian based distros you can use
```
aptitude install poppler-utils
aptitude install html2text
```

# Usage

Download some reports in html or pdf format

Then feed them to tool like this
```
./intel_generator.sh -f apt_report.pdf -p
```

This basic example will generate intel files with IOCs such as Domains, IPs and hashes
inside current directory

Please note that sometimes indicators extracted would be incorrect and it is good idea to check files generated before using them in production

At the moment only domains, ips and hash indicators are supported

We assume reports contain separate section list of indicators posted like in Appendix

There is also a possibility that files with extensions will be matched by our domain matching regexp, so there is a variable to exclude them
see code below

```
domain_exclude="(*.exe|*.gif|*.jpg|*.jpeg|*.swf|*.jar)$"
```

Then you install them in bro and you good to go

For installing them in Bro you need to do the following:

Copy resulting intel directory into bro policy directory
```
cp -r intel /usr/local/bro/share/bro/policy/
```
Add intel into local.bro script
```
@load intel
```

Install and restart new bro policy with
```
 broctl install && broctl restart
```
# How to generate IOCs from multiple files

Download reports into single folder

To generate IOCs from all of them do the following:
```
cd apt_reports
IFS=$'\n'
for i in `ls`; do ../bro-intel-generator/intel_generator.sh -f $i -p;done
unset IFS
```

After command complete you will have intel folder in the same directory

with all IOCs.

bro-intel-generator

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

bro-intel-generator

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README