bro-scripts.yml

---
## Note: if you edit anything here, adapt templates/local.bro as needed

- name: Git clone seth hall APT1
  ansible.builtin.git:
    repo: https://github.com/sethhall/bro-apt1
    dest: "{{ broids_site }}/apt1"
    version: "{{ broids_scripts_version | default('cfb5623ab4e8e5b2ec46b453aff990e559c6b889') }}"
- name: Git clone Crowdstrike bro scripts
  ansible.builtin.git:
    repo: https://github.com/CrowdStrike/cs-bro.git
    dest: "{{ broids_site }}/cs-bro"
    version: "{{ broids_scripts_version | default('fed8ec6d1fc93a7e149973cd6e5b3e02cc4410f4') }}"
    update: no
- name: Git clone jonschipp bro scripts
  ansible.builtin.git:
    repo: https://github.com/jonschipp/bro-scripts.git
    dest: "{{ broids_site }}/jonschipp-bro"
    version: "{{ broids_scripts_version | default('54b7f663325297012b4a49de359a286712f8dc15') }}"
- name: Git clone securitykitten bro scripts
  ansible.builtin.git:
    repo: https://github.com/securitykitten/bro_scripts.git
    dest: "{{ broids_site }}/securitykitten-bro"
    version: "{{ broids_scripts_version | default('f1881b3d1d37e9775130dd300498539bd4336651') }}"
    update: no
- name: Git clone fox-it bro scripts
  ansible.builtin.git:
    repo: https://github.com/fox-it/bro-scripts.git
    dest: "{{ broids_site }}/foxit-bro"
    version: "{{ broids_scripts_version | default('b3aa56dbfb2a149dafea3302ce978b0a978b5c52') }}"
- name: Git clone criticalstack bro scripts
  ansible.builtin.git:
    repo: https://github.com/criticalstack/bro-scripts.git
    dest: "{{ broids_site }}/criticalstack"
    version: "{{ broids_scripts_version | default('5d76c03e783b6983d7f81974415b5c37344677df') }}"
- name: Git clone sooshie bro scripts
  ansible.builtin.git:
    repo: https://github.com/sooshie/bro-scripts.git
    dest: "{{ broids_site }}/sooshie-bro"
    version: "{{ broids_scripts_version | default('42cbbabcc40959466fd7c716370eb3d7617ce9fc') }}"
- name: Git clone dovehawk bro scripts - MISP
  ansible.builtin.git:
    repo: https://github.com/tylabs/dovehawk.git
    dest: "{{ broids_site }}/dovehawk"
    version: "{{ broids_scripts_version | default('1099f4babffd77b511127f358d2a50d144d08141') }}"

## from https://www.bro.org/download/CHANGES.bro.txt, 2.3-404
- name: Update script s/split_all/string_split/all in detect-shellshock.bro
  ansible.builtin.replace:
    dest: "{{ broids_site }}/cs-bro/bro-scripts/shellshock/detect-shellshock.bro"
    regexp: "{{ item.re }}"
    replace: "{{ item.rep }}"
    mode: '0644'
    backup: yes
  with_items:
    ## line 32: unknown identifier string_split_all
    # - { re: split_all, rep: string_split_all }
    - { re: find_ip_addresses, rep: extract_ip_addresses }
# - name: update script s/split_all/string_split/all in bro_typosquatting.bro
#   replace:
#     dest: "{{ broids_site }}/securitykitten-bro/bro_typosquatting.bro"
#     regexp: split_all
#     replace: string_split_all
#     backup: yes

## https://github.com/MISP/MISP/issues/424
- name: Misp2bro
  when: broids_misp_url is defined and broids_misp_url and broids_misp_agent == 'misp2bro'
  block:
    - name: Git clone misp2bro
      ansible.builtin.git:
        repo: https://github.com/thnyheim/misp2bro.git
        dest: "{{ broids_site }}/misp2bro"
        version: "{{ broids_scripts_version | default('eea82a3a601f873f8494605a859460231122dd29') }}"
        update: no
    - name: Update misp2bro config
      ansible.builtin.replace:
        dest: "{{ broids_site }}/misp2bro/misp2bro.py"
        regexp: "{{ item.re }}"
        replace: "{{ item.rep }}"
        backup: yes
        mode: '0644'
      with_items:
        - { re: '^MISP_HOST=".*"', rep: "MISP_HOST=\"{{ broids_misp_url }}\"" }
        - { re: '^API_KEY=".*"', rep: "API_KEY=\"{{ broids_misp_apikey }}\"" }
        - { re: '^BRO_FILENAME=".*"', rep: "BRO_FILENAME=\"{{ broids_misp2bro_output | basename }}\"" }
        - { re: '^BRO_PATH=".*"', rep: "BRO_PATH=\"{{ broids_misp2bro_output | dirname }}\"" }
        - { re: 'logging.basicConfig\(filename=".*"',
            rep: "logging.basicConfig(filename=\"{{ broids_log }}/misp2bro.log\""
        }
        - { re: '"tmp/', rep: "\"{{ broids_spool }}/misp2bro/" }
        ## https://github.com/thnyheim/misp2bro/pull/1
        - { re: " if int\\(event.find\\('attribute_count'\\).text\\)",
            rep: " #if int(event.find('attribute_count').text)"
        }
        # no_log: true
    - name: Update misp2bro sensors.txt
      ansible.builtin.template:
        src: misp2bro-sensors.txt.j2
        dest: "{{ broids_site }}/misp2bro/sensors.txt"
        mode: '0644'
        backup: yes
    ## Note: if Killed, probably lacking memory (check oom in kern.log)
    ##  OR UnicodeEncodeError: 'ascii' codec can't encode character u'\\u201c' in position 143: ordinal not in range(128)
    - name: Run misp2bro once
      ansible.builtin.command: "python {{ broids_site }}/misp2bro/misp2bro.py"
      args:
        creates: "{{ broids_misp2bro_output }}"
      failed_when: false
    - name: Ensure misp2bro cron task is present
      ansible.builtin.cron:
        name: "misp2bro refresh"
        minute: 0
        hour: 12
        user: "root"
        job: "python {{ broids_site }}/misp2bro/misp2bro.py > /tmp/misp2bro-cron.out"
        cron_file: ansible_misp2bro-refresh

## http://feathub.com/MISP/MISP/+21
## or curl ? http://10.252.116.20/events/downloadExport/bro
- name: Import misp-integration
  ansible.builtin.import_tasks: misp-integration.yml
  when: broids_misp_url is defined and broids_misp_url and broids_misp_agent == 'curl'

- name: Copy zeek plugins from templates
  ansible.builtin.template:
    src: "zeek-{{ item }}.zeek.j2"
    dest: "{{ broids_site }}/{{ item }}.zeek"
    mode: '0644'
    backup: yes
  with_items: "{{ broids_plugins_templates }}"

- name: Import ja3
  ansible.builtin.import_tasks: ja3.yml
  when: broids_ja3_enable

- name: Import ja4
  ansible.builtin.import_tasks: ja4.yml
  when: zeek_ja4_enable | bool

## Anything to recover?
##  https://github.com/Security-Onion-Solutions/securityonion-bro-scripts
## https://github.com/LiamRandall/bro-scripts
## https://github.com/sethhall/bro-scripts
## https://github.com/TravisFSmith/MyBroElk
## https://gist.github.com/mavam/5028034