log-filters

Common log filters for Bro IDS

This is a Bro package that provides commonly requested log filters. These filters either modify or prevent the logging of events or records.

Installing with bro-pkg (preferred)

This package can be installed through the bro package manager by utilizing the following commands:

bro-pkg install bro/hosom/log-filters

# you must separately load the package for it to actually do anything
bro-pkg load bro/hosom/log-filters

The package installs with no log filters configured, however, log filters can be defined and loaded safely within config.bro.

The filters are described below.

A filter that restricts the files.log to only files that have a specified file analyzer attached to them.

To load this filter, add the following line to your config.bro:

@load filters/whitelist-analyzers-fileslog

To whitelist an analyzer, redef the set logged_file_analyzers.

A filter that restricts the files.log to only files that have a specified file mimetype detected.

To load this filter, add the following line to your config.bro:

@load filters/whitelist-mimetypes-fileslog

To whitelist a mimetype, redef the set logged_file_mimetypes.