{"permissions":{},"commerce":{"user_subscriptions":null,"subscription_plans":[],"global_tracking_code":"","conversion_tracking_code":"\n<script src="//platform.twitter.com/oct.js" type="text/javascript"></script>\n<script type="text/javascript">twttr.conversion.trackPid('nxgvm', { tw_sale_amount: 0, tw_order_quantity: 0 });</script>\n<noscript>\n<img height="1" width="1" style="display:none;" alt="" src="https://analytics.twitter.com/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n<img height="1" width="1" style="display:none;" alt="" src="//t.co/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n</noscript>\n\n\n\n\n\n\n<script>\n gtag('event', 'conversion', {\n 'send_to': 'AW-779065575/jLMdCKTdhI8BEOexvvMC',\n 'transaction_id': ''\n });\n</script>","payment_requires_zip_code":false,"currency_code":"usd"},"media":{"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&ixlib=python-1.1.0&w=500&s=67714604a0a4dd036627a0b24d864157","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=250&ixlib=python-1.1.0&w=250&s=dd186d13312ece08824791a21b8f85ac","logo":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FwlZeWsU7RmexXY78HFKG%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&h=200&ixlib=python-1.1.0&w=600&s=3e88e4a65c1be65bf90a14c62bb9ddd8","url":"//d1do9mm1n6degf.cloudfront.net/","banners":[{"id":908,"school_id":5379,"background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FfJx85Y2NQeCeXz6Ou47r%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=0a17a1f2151f9c1fa92974d6a8410ff3","background_type":1,"background_overlay":"0,0,0,0.2","heading":"Applied Network Defense","subhead":"Information Security Training","readability":true,"button_text":"","button_func":"url","button_url":"","order":0,"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FfJx85Y2NQeCeXz6Ou47r%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=0a17a1f2151f9c1fa92974d6a8410ff3","font_color":"ffffff","is_visible":true,"hide_for_subscription_plans":[],"show_for_subscription_plans":[]}],"theme":{"id":283,"name":"Applied Network Defense - 7600","description":"","primary_color":"0d71fb","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=cb76712ea91191b11d11e186e7c71b3d","heading_font":"","typekit_id":"","custom_css":"","theme_css_url":null,"typekit_scripts":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=700&high=-80&ixlib=python-1.1.0&q=100&w=700&s=7a4e72884667a9e2ef8fba320516b46a","background_overlay":"0,0,0,0","background_type":1,"background_image_raw":"https://cdn.filestackcontent.com/B8TQJqo9RoOCyIQVKYNa"},"pages":[]},"school":{"id":5379,"name":"Applied Network Defense","platform_version":2.2,"url":"https://www.networkdefense.io/","is_ssl_disabled":false,"is_curriculum_licensor":false,"is_curriculum_subscriber":false,"is_activated":true,"is_activated_via_override":false,"resource_licensing_enabled":false,"trial_has_expired":false,"trial_days_remaining":null,"is_curriculum_enabled":true,"has_public_resources":true,"billing_model_display":"User (Pathwright 2)","billing_model":10,"website":"","has_certificate":true,"subdomain":"networkdefense","ietf_language_tag":"en-US","short_description":"Affordable, effective, online information security training. Made by analysts, for analysts.","has_consent_description":false},"support":{"has_faqs":false,"support_email":"chris@chrissanders.org","support_phone":"","support_link":"","support_policy":"

Course support is provided by e-mail. Most questions will be answered within 24 hours.

","support_faqs":null},"security":{"terms_of_service":"https://www.networkdefense.io/pages/terms-of-use.html","privacy_policy":"https://www.networkdefense.io/pages/privacy-policy.html","csrf_token":"KJwc7P0zKBtv3Z6xPNGiI21WLDy9d2PzwtEg0PPIMlzkuCRmsrXv6EhoSm2KfCj0","terms_agreement_prompt_override":""},"social":{"twitter_username":"","facebook_username":"","google_plus_username":"","pinterest_username":""},"integrations":{"facebook":null,"filepicker":{"read_policy":"eyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0=","read_signature":"888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34"},"algolia":false,"intercom":{"app_id":null,"school_app_id":null,"school_staff_app_id":null,"pathwright_app_id":"5txzvi2k","segment":false,"school_profile":null},"stripe":{"publishable_key":"pk_live_KFOuFb4HE2BpHFfGHilvfHmK"},"firebase":null,"google_analytics":{"account_id":"UA-92588624-1","domain_name":"pathwright.com"},"sso":{"pathwright_login_enabled":true,"providers":[],"current_provider":null}},"customizations":{"head_markup":["","\n\n\n\n"],"script_markup":["\n\n\n"],"global_tracking_code":""},"pathwright_account":{"is_on_legacy_plan":false,"is_activated":true,"payment_key":"pk_V26ZEKLGb9otX6E1CRSVns4V7Im9e","subscription":{"id":909,"school":5379,"plan":{"id":16,"name":"Essentials 2.0","image":null,"description":"For launching a full online school & community.","amount":99.0,"fee_per_additional_learner":0.0,"features":{"1-staff-member":true,"create-unlimited-courses":true,"start-at-1000-active-learners":true,"free-course-design-courses":true,"sell-courses-with-commerce":true,"friendly-email-support":true,"starts-with-5-staff-members":true,"use-your-own-domain-name":true,"essential-app-integrations":true,"guided-course-design-courses":true,"sell-subscriptions":true,"priority-email-support":true},"plan_order":2,"plan_color":"6bc288","visibility":15,"learners_included":1000,"user_discount_func":{"id":1,"name":"Default Range Discount","method_name":"applyRangeDiscount","method_body_js":"function applyRangeDiscount(users, rate) {\n var thresholds = [0, 10,30,50,100,250,500,1000]\n function calcDiscount(threshold) {\n var perc = threshold / thresholds[thresholds.length-1]\n var min = .25\n var max = .75\n var discount = ((max - min) * perc) + min\n return discount\n }\n var discount = 0\n var discountableUsers = users\n for (var i=thresholds.length-1; i >= 0;--i) {\n var threshold = thresholds[i]\n //console.log(users + \" > \" + threshold, i, users>threshold)\n if (users > threshold) {\n var usersToDiscount = (discountableUsers - threshold)\n var userDiscount = usersToDiscount * calcDiscount(threshold)\n //console.log(\"discounting \" + usersToDiscount + \" users at \" + userDiscount)\n discount += userDiscount\n discountableUsers -= usersToDiscount\n }\n }\n return discount}"},"should_contact_for_pricing":false,"intervals_by_month":[{"interval_id":5,"months":1,"amount_per_cycle":99.0,"amount_per_month":99.0,"discount_percent":0.0,"discounted_amount_per_month":99.0,"discounted_amount_per_cycle":99.0,"discount_per_month":0,"discount_per_cycle":0},{"interval_id":7,"months":6,"amount_per_cycle":594.0,"amount_per_month":99.0,"discount_percent":0.05,"discounted_amount_per_month":94.0,"discounted_amount_per_cycle":564.0,"discount_per_month":5,"discount_per_cycle":30},{"interval_id":10,"months":12,"amount_per_cycle":1188.0,"amount_per_month":99.0,"discount_percent":0.1,"discounted_amount_per_month":89.0,"discounted_amount_per_cycle":1068.0,"discount_per_month":10,"discount_per_cycle":120},{"interval_id":20,"months":1,"amount_per_cycle":99.0,"amount_per_month":99.0,"discount_percent":0.0,"discounted_amount_per_month":99.0,"discounted_amount_per_cycle":99.0,"discount_per_month":0,"discount_per_cycle":0}],"scholarships_available":false},"subscription":{"id":34550,"card_last_4":"1907","subscription_plan":{"id":84,"amount":0.0,"interval":5,"trial_period_days":0,"trial_type":null},"is_delinquent":false,"cycle_start_dtime":"2019-06-11T16:03:37-04:00","cycle_end_dtime":"2019-07-11T16:03:37-04:00","canceled_dtime":null,"provider_school_stripe_key":null,"trial_type":null,"trial_end_dtime":null,"paused_until_dtime":null,"is_canceled_at_cycle_end":false,"cancellation_reason":null},"interval":5,"additional_learners_included":0}},"user":null,"session":{"user":null,"school_membership":null,"csrf_token":"dhTSTHJB6N40lCJoXGA9kq3LBfgQwFwVZ11WMHyK8xaPMfudAkRmI2jdIYKryf0m","search":{"school_membership":{"key":"be9ac87997ff4f1692ea165248f18a13d9ff9021782107af47c4161c60c8feca","params":{"tagFilters":["school_5379"],"validUntil":1560999325,"restrictIndices":"prod_school_membership"}},"index_prefix":"prod_"},"firebase":null,"is_authenticated":false},"DEBUG":false,"resource":{"id":27420,"name":"Bro Scripting","description":"

If you miss an attacker on your network, it's probably not
because you don't have enough data. It's more likely that you have too much data. That's where Bro comes in.

Bro is the world's most flexible network security platform and thousands of organizations use it to reduce network packet streams down to noteworthy events. While Bro's out-of-the-box capabilities are robust, they just scratch the surface. Bro isn't just a tool, it's a programming language. That means Bro…

…is an IDS that can be used to go beyond signature-based matching and detect things that might be missed.
…will match complex sequences of events that arebenign by themselves, but malicious when occurring together.
…can generate statistics for anomaly detection andnetwork-based hunting.
…produces evidence useful for enriching and investigating alerts from other tools.

Hands-On Bro Scripting is a foundational course that will help you unlock the flexibility of Bro to make sure you have the right data at the right time. When you take this course, you'll learn:

The fundamentals of Bro scripting with hands-on, real-world scripts being developed along the way.
Effective approaches for maximizing your sensor resources.
How to effectively filter log data to minimize network bandwidth use
Techniques for debugging and analyzing new and existing scripts
Best practices for building your own custom bro events.
How to leverage Bro's frameworks: intel, file analysis, input, summary statistics, notice, and conn threshold.

You'll also develop useful foundational scripts you can use
to guide your detection and analysis. This includes scripts for detecting large HTTP flows, extracting files based on MIME type, determining the ratios of HTTP methods, firing events based on connection thresholds, and protocol filtering scripts.

Course Format
Hands-On Bro Scripting is delivered completely online using recorded video lectures that you can go through at your own pace. Each lesson consists of lectures that overview critical concepts, instructor-led demonstrations that walk through Bro examples, and lab exercises when you practice the concepts you’ve learned. There is also a discussion forum where you can ask questions and share tips and tricks with other students and your instructor.

Prerequisites
This is a scripting course and assumes some level of programming knowledge. You should have experience with another scripting language (Perl, Python, etc), and a basic understanding of programming concepts.
A basic understanding of Bro is helpful, although not fully required.
This course is delivered in English.

Cost
Early bird pricing for the course is $747 for a single user license. Bulk discounts are available for organizations that want to purchase multiple licenses (please contact me to discuss payment and pricing). A portion of the purchase price will go to support multiple charities including the Rural Technology Fund, the Against Malaria Foundation, and others.
You’ll receive:

1 year access to course video lectures and lab exercises
A Certification of Completion
Continuing Education Credits (CPEs/CEUs)

About the Instructor
Aaron Eppert is the Director of Engineering for PacketSled
and the principal engineer of PacketSled's Bro-Based Sensor technology. Over the course of working with Bro, Aaron has committed pull requests to the Bro Open Source Repository, including numerous bug fixes and driving the finalization and inclusion of the SMB Protocol Analyzer. He is an accomplished expert in the Bro Scripting Language, Bro protocol analyzer development as well as a sought after trainer and mentor of the Bro Ecosystem. Aaron is an expert in low-level programming, optimization and high-speed network filtering with accomplishments spanning twenty years. He is a recognized Industry expert in protocol analysis, reverse engineering and software engineering and implementation.

FAQ
Q: Who is this course designed for?
A: Anyone who wants to learn how to use Bro for intrusion detection or security investigations. This course is specifically targeted at security investigators, NSM analysts, detection engineers, and security tool developers.

Q: How much Bro experience should I have before starting?
A: A basic familiarity with Bro and its default data output is helpful. Understanding the official Bro quickstart document is a great place to start: (https://www.bro.org/sphinx/quickstart/index.html).

Q: How much programming experience should I have before starting?
A: This is a scripting course and assumes some level of programming knowledge. You should have experience with another scripting language (Perl, Python, etc), and a basic understanding of programming concepts.

Q: Are there any hands on labs?
A: Yes! Lots of them. You’ll have plenty of opportunities to practice the techniques we discuss. The class is loaded with demonstrations you can follow along with, too! If you run into troubles, you can ask your course peers and the instructor, who is an expert Bro developer.

","short_description":"Hands-On Bro Scripting is a foundational course that will help you unlock the flexibility of Bro. You'll learn to build scripts to perform detection and generate useful logs for investigating breaches.","categories":[{"id":2727,"name":"Computer Security","slug":"computer-security","description":"","order":0,"resources_count":11},{"id":952,"name":"Information Technology","slug":"information-technology","description":null,"order":0,"resources_count":11}],"image":"","cover_image":"https://cdn.filestackcontent.com/6tv9MRzjThGxaNHr0VdN","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2F6tv9MRzjThGxaNHr0VdN%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=1&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=f62dd7a6da43bdc8ca9762f5613175ac","thumb_2x":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2F6tv9MRzjThGxaNHr0VdN%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=2&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=e795cc8f012b09fdfcaec09ac56e9b98","icon":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2F6tv9MRzjThGxaNHr0VdN%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=35&ixlib=python-1.1.0&w=35&s=5e930258507f0ff0ac2e24428be576b3","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FxWEOXokYSfWa4nU05iF2%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&high=-80&ixlib=python-1.1.0&q=100&w=1400&s=ee12ff4588d5faa0b2fb28e194b2e1ef","background_overlay":"0,0,0,0.2","background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FxWEOXokYSfWa4nU05iF2%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=500&high=-80&ixlib=python-1.1.0&q=100&w=500&s=2fc350b85065c3bb6e1b1853a0ad3563","background_type":5,"authors":[{"id":958,"display_name":"Aaron Eppert","first_name":"Aaron","last_name":"Eppert","bio":"

Aaron is the Director of Engineering for PacketSled and has been active in engineering for over twenty years. His specific areas of interest revolve around security, embedded programming, algorithm design, and programming language implementation and optimization. He works extensively with Bro and has contributed to its codebase.

","image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FMlSWGZoTXWjVGtyKuKUA%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=115&ixlib=python-1.1.0&w=115&s=b572ce8b24b4dcde3a1ebb2d1b673cc0","resources_count":1,"salutation":"","title":"Director @ PacketSled","slug":"aaron-eppert","order":0,"avatar":"https://cdn.filestackcontent.com/MlSWGZoTXWjVGtyKuKUA"}],"created":"2017-05-11T16:45:11.551424-04:00","url":"https://www.networkdefense.io/library/bro-scripting/","offering_counts":{},"resource_type":10,"resource_type_display":"Course","slug":"bro-scripting","trailer_embed_code":"","list_order":null,"total_registration_count":50,"sum_registration_count":85,"lowest_public_offering_price":747.0,"highest_public_offering_price":747.0,"group_offering":null,"curriculum_offering":null,"num_offerings":2,"visibility_level_override":null,"licensing_enabled":false,"license_offerings":[],"licensed_from_resource":null,"certificate_generator_class":"CertificateGenerator","lowest_price_currency_display":"$747.00 USD","highest_price_currency_display":"$747.00 USD","discussion_enabled":true,"licensed_from_school":null},"offering":{"id":58700,"name":"","access_starts":null,"access_ends":null,"enrollment_starts":null,"enrollment_ends":null,"description":"","visibility":15,"price":0.0,"seats":null,"seats_filled":0,"seats_available":-1,"price_for_user":0.0,"currency_display":"$0.00 USD","include_in_subscription_plans":[],"is_subscription_only":false,"resource_id":27420,"path_id":1419443,"permissions":{"can_participate":false,"can_register":true,"can_access":false,"can_edit":false,"can_edit_resource":false,"can_facilitate":false,"can_view_analytics":false,"can_invite_editor":false,"can_invite_teacher":false,"can_invite_moderator":false,"can_invite_student":false,"can_invite_observer":false},"due_dates_enabled":false,"is_group_offering":false,"step_counts":{"total":163,"reading":1,"video":132},"is_curriculum":true,"url":"/library/bro-scripting/58700/","invite_urls":{},"grade_report_url":null,"access":{"is_full":false,"has_registration_ended":false,"has_registration_started":true,"has_access_started":true,"has_access_ended":false},"analytics_visibility":5,"staff":[],"resource_license":null,"discussion_enabled":true,"parent_offering_id":null}}

Loading Bro Scripting...