BroAPT-Core Framework

The BroAPT-Core framework is the extraction framework for the BroAPT system. For more information about the framework, please refer to previous documentation at BroAPT-Core Extration Framework.

Bro Scripts

• Module Entry
• Configurations
• MIME-Extension Mappings
• FileExtraction Module
• Extract by Protocol
• Extract by MIME Type
• Site Customisations

Python Modules

• Module Entry
• System Entrypoint
• Bro Script Composer
  • Introduction
  • Functions
  • Constants
    • Auxiliaries
    • Bro Configs
    • Subsitute Patterns
• Common Constants
• Bro Log Parser
  • Dataclasses
  • Field Parsers
  • Log Parsers
  • Module Entry
• Extraction Process
• Bro Logs Processing
  • Hook Mainloop
  • Warnings
  • Signal Handling
    • Bundled Implementation
    • Cluster Implementation
• Auxiliaries & Utilities
• Site Customisations

Wrapper Scripts

For the Docker container, we have created some Shell/Bash wrapper scripts to make the life a little bit better.

Bundled Implementation

File location

source/client/init.sh

#!/usr/bin/env bash

set -aex

# change curdir
cd /broapt

# load environs
if [ -f .env ] ; then
    source .env
fi

# compose Bro scripts
/usr/bin/python3.6 python/compose.py

# run scripts
/usr/bin/python3.6 python $@

# sleep
sleep infinity

Cluster Implementation

File location

cluster/core/source/init.sh

#!/usr/bin/env bash

set -aex

# change cwd
cd /source

# load environs
if [ -f .env ] ; then
    source .env
fi

# compose Bro scripts
/usr/bin/python3.6 python/compose.py

# run scripts
/usr/bin/python3.6 python $@

# sleep
sleep infinity