1. Standardized flow hashing for all your NSM tools
Community ID
Standardized flow hashing
for all your NSM tools
Christian Kreibich
@ckreibich

2. Typical BroZeek log entries
conn.log {
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... }
http.log {
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"trans_depth":1,
"method":"GET",
"uri": ...,
"request_body_len": 0,
... }

3. Typical BroZeek log entries
conn.log {
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... }
http.log {
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"trans_depth":1,
"method":"GET",
"uri": ...,
"request_body_len": 0,
... }

4. Typical BroZeek log entries
conn.log {
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... }
http.log {
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"trans_depth":1,
"method":"GET",
"uri": ...,
"request_body_len": 0,
... }
w00t!

5. Typical Suricata log entries (eve.json){
"timestamp": " T07:51...",
"flow_id": ,
"event_type": "http",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"tx_id": 0,
"http": {
"http_port": 0,
"url": "/scripts/..%c1%9c../...",
"http_method": "GET",
"length": 0 } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
"category": "Misc activity",
... }

6. Typical Suricata log entries (eve.json){
"timestamp": " T07:51...",
"flow_id": ,
"event_type": "http",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"tx_id": 0,
"http": {
"http_port": 0,
"url": "/scripts/..%c1%9c../...",
"http_method": "GET",
"length": 0 } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
"category": "Misc activity",
... }

7. Typical Suricata log entries (eve.json)
ALSO w00t! {
"timestamp": " T07:51...",
"flow_id": ,
"event_type": "http",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"tx_id": 0,
"http": {
"http_port": 0,
"url": "/scripts/..%c1%9c../...",
"http_method": "GET",
"length": 0 } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
"category": "Misc activity",
... }

8. Typical BroZeek-and-Suricata log entries{
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
"category": "Misc activity",
... }

9. Typical BroZeek-and-Suricata log entries{
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
"category": "Misc activity",
... }

10. Typical BroZeek-and-Suricata log entries{
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
"category": "Misc activity",
... }
ARGH!

12. Standardized flow hashing for all your NSM tools
Community ID
Standardized flow hashing
for all your NSM tools

13. ID = version ∙ ‘:’ ∙ base64(sha1(seed ∙ 5-tuple))

14. Typical BroZeek-and-Suricata log entries{
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
... } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
..., }

15. Typical BroZeek-and-Suricata log entries{
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
...,
"community_id":
"1:ZEYOYMeyZNQC9DAdgsBZCtiTKqw=" } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"community_id":
"1:ZEYOYMeyZNQC9DAdgsBZCtiTKqw=",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
..., }

16. Typical BroZeek-and-Suricata log entries{
"ts": ,
"uid":"CVKjZo2GrV8DM0Fvo5",
"id.orig_h":" ",
"id.orig_p":3051,
"id.resp_h":" ",
"id.resp_p":80,
"proto":"tcp",
"service":"http",
"duration": ,
...,
"community_id":
"1:ZEYOYMeyZNQC9DAdgsBZCtiTKqw=" } {
"timestamp": " T07:51...",
"flow_id": ,
"pcap_cnt": 10,
"event_type": "alert",
"src_ip": " ",
"src_port": 3051,
"dest_ip": " ",
"dest_port": 80,
"proto": "TCP",
"community_id":
"1:ZEYOYMeyZNQC9DAdgsBZCtiTKqw=",
"alert": {
"action": "allowed",
"gid": 1,
"signature_id": ,
"rev": 1,
"signature": "PWNED!",
..., }
DOU B LE w0Ot!

17. Current status Intentionally basic — feedback very welcome!
➜ Github tickets or BroZeek mailing list
Spec and reference implementation:
BroZeek package & plugin:
Included in upcoming Suricata 4.1
community-id/v17