User Tools
scripting:introbro
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
|
scripting:introbro [2018/09/28 14:02] veera [Two scripting pipelines in Trisul] |
scripting:introbro [2018/09/28 17:48] (current) veera |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Introduction to Trisul Scripting for Bro IDS users ====== | ====== Introduction to Trisul Scripting for Bro IDS users ====== | ||
| - | Bro IDS is a popular open source network analysis platform. A key feature of Bro IDS is the custom BRO language that allows you to write scripts to enhance the functionality of the platform. Trisul Network Analytics is also a platform that can be extended by writing scripts. This page introduces the Trisul Scripting API for those who are already familiar with Bro IDS scripting. | + | A key feature of the popular open source network analysis platform Bro IDS is the custom BRO language. It allows you to write scripts to enhance the functionality of the platform. Trisul Network Analytics is also a platform that can be extended by writing scripts. This page introduces the Trisul Scripting API for those who are already familiar with Bro IDS scripting. |
| - | ===== Trisul API ===== | + | ===== Trisul scripting ===== |
| - | ==== Outputs : database objects vs logs ==== | + | There are two differences between the Bro and Trisul approaches. Lets sort them out before diving deeper. |
| + | First, Trisul integrates the packet processing as well as the database.So you directly work with database objects like metrics , resources, flows, documents, and graphs.This can be a bit confusing to Bro scripters who focus on generating logs and notices. | ||
| - | Trisul is built from ground up to be full streaming analytics platform - database included. In Trisul, you work directly with database objects like metrics , resources, flows, documents, and graphs.This can be a bit confusing to Bro scripters who focus on generating logs. | + | A second difference is, You can script either the packet processing stream or the analytics stream. We call these two streams the [[https://www.trisul.org/docs/lua/basics.html#frontend_and_backend_scripts|Frontend (Fastpath) or the Backend (slowpath)]]. They communicate using a messaging API. This can be a bit odd to newcomers because the backend scripts have a longer time budget to execute. |
| - | + | ||
| - | To illustrate with an example. | + | |
| - | + | ||
| - | **Say you are calculating TLS Fingerprints from network traffic** | + | |
| - | + | ||
| - | * In Bro, you might write scripts to add the fingerprint to the connection/flow log. | + | |
| - | * In Trisul, your approach would be to create a new counter group for TLS Fingerprints and count each print there. You can also mark the flows like Bro, or create graph edges, but the main focus is on metrics. | + | |
| - | + | ||
| - | ==== Two scripting pipelines in Trisul ==== | + | |
| - | + | ||
| - | + | ||
| - | A second architectural difference is : In Trisul, you can script either the packet processing stream or the analytics stream. We call these two streams the Frontend (Fastpath) or the Backend (slowpath). The Frontend / Fastpath scripts work on packets and reassembled payloads, and the Backend scripts work on objects like traffic metrics for a particular entity, Top-K, flows, resources, etc. The two pipelines can talk to each other using a messaging API. | + | |
| === Comparison === | === Comparison === | ||
| Line 53: | Line 41: | ||
| For more on this refer to [[https://www.trisul.org/docs/lua/selector.html|Script selector cheat sheet]] | For more on this refer to [[https://www.trisul.org/docs/lua/selector.html|Script selector cheat sheet]] | ||
| - | |||
| - | |||
| To conclude, this was a quick introduction to Trisul scripting. We will be diving deeper into each of the areas in the coming days. | To conclude, this was a quick introduction to Trisul scripting. We will be diving deeper into each of the areas in the coming days. | ||
scripting/introbro.1538143329.txt.gz · Last modified: 2018/09/28 14:02 by veera
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
