Browse Source

README

master
boB Rudis 3 years ago
parent
commit
d68ac96d92
No known key found for this signature in database GPG Key ID: 1D7529BE14E2BBA9
  1. 2
      DESCRIPTION
  2. 2
      R/brimr-package.R
  3. 10
      README.Rmd
  4. 6
      README.md
  5. 2
      man/brimr.Rd

2
DESCRIPTION

@ -9,7 +9,7 @@ Authors@R: c(
)
Maintainer: Bob Rudis <bob@rud.is>
Description: Brim (<https://github.com/brimsec/brim>) enables efficient query
operations on large packqet captures and log sources, such as Zeek. Tools
operations on large packet captures and log sources, such as Zeek. Tools
are provided to with with Brim components, including the Brim zqd query back-end.
URL: https://git.rud.is/hrbrmstr/brimr
BugReports: https://git.rud.is/hrbrmstr/brimr/issues

2
R/brimr-package.R

@ -1,7 +1,7 @@
#' Tools to Work with Brim and zqd
#'
#' Brim (<https://github.com/brimsec/brim>) enables efficient query
#' operations on large packqet captures and log sources, such as Zeek. Tools
#' operations on large packet captures and log sources, such as Zeek. Tools
#' are provided to with with Brim components, including the Brim zqd query back-end.
#'
#' @md

10
README.Rmd

@ -42,13 +42,13 @@ packageVersion("brimr")
### Available Brim "spaces"
```{r available-brim-spaces}
```{r available-brim-spaces, cache=TRUE}
brim_spaces()
```
### Sample ZQL query
```{r sample-zql-query}
```{r sample-zql-query, cache=TRUE}
# Z query to fetch Zeek connection data to create our network connection graph
zql1 <- '_path=conn | count() by id.orig_h, id.resp_h, id.resp_p | sort id.orig_h, id.resp_h, id.resp_p'
@ -59,7 +59,7 @@ cat(
### Let's execute the query
```{r zeek-query-execution}
```{r zeek-query-execution, cache=TRUE}
space <- "2021-02-17-Trickbot-gtag-rob13-infection-in-AD-environment.pcap"
r1 <- brim_search(space, zql1)
@ -71,7 +71,7 @@ r1
### Let's try one that processes the Suricata alerts
```{r suricata-query-execution}
```{r suricata-query-execution, cache=TRUE}
# Z query to fetch Suricata alerts including the count of alerts per source:destination
zql2 <- "event_type=alert | count() by src_ip, dest_ip, dest_port, alert.severity, alert.signature | sort src_ip, dest_ip, dest_port, alert.severity, alert.signature"
@ -82,7 +82,7 @@ r2
(r2 <- (as_tibble(tidy_brim(r2))))
```
```{r graph, fig.width = 9}
```{r graph, fig.width = 9, cache=TRUE}
library(igraph)
library(ggraph)
library(tidyverse)

6
README.md

@ -19,9 +19,9 @@ Tools to Work with Brim and zqd
## Description
Brim (<https://github.com/brimsec/brim>) enables efficient query
operations on large packqet captures and log sources, such as Zeek.
Tools are provided to with with Brim components, including the Brim zqd
query back-end.
operations on large packet captures and log sources, such as Zeek. Tools
are provided to with with Brim components, including the Brim zqd query
back-end.
## What’s Inside The Tin

2
man/brimr.Rd

@ -7,7 +7,7 @@
\title{Tools to Work with Brim and zqd}
\description{
Brim (\url{https://github.com/brimsec/brim}) enables efficient query
operations on large packqet captures and log sources, such as Zeek. Tools
operations on large packet captures and log sources, such as Zeek. Tools
are provided to with with Brim components, including the Brim zqd query back-end.
}
\seealso{

Loading…
Cancel
Save