malice-bro (WIP)

Malice Bro Plugin - Scan PCAP or bind to interface and scan files off the wire.

Dependencies

• blacktop/bro

Installation

1. Install Docker.
2. Download trusted build from public DockerHub: docker pull malice/bro

Usage

docker run --rm malice/bro

Or link your own malware folder:

$ docker run --rm -v /path/to/malware:/malware:ro malice/bro PCAP

Sample Output

JSON:

{
  "bro": {
  }
}

STDOUT (Markdown Table):

Bro

Documentation

Issues

Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don’t hesitate to file an issue.

CHANGELOG

See CHANGELOG.md

Contributing

See all contributors on GitHub.

Please update the CHANGELOG.md and submit a Pull Request on GitHub.

License

MIT Copyright (c) 2016-2017 blacktop