Bro produces data about a number of different network protocols. View which types of protocols exist in the data.

​

Figure 4.2. Bro Protocols

View when Bro telemetry information was received.

You can check for any odd gaps and fluctuating periods of high and low activity.

	Note
	If there is not enough data for this visualization to be interesting, let Metron consume more data before continuing.

​

Figure 4.3. Bro Telemetry Received

List the most active Bro hosts.

​

Figure 4.4. Most Active Hosts

List any DNS servers running on non-standard ports.

​

Figure 4.5. DNS Servers

List any mime types that could be concerning.

​

Figure 4.6. Mime Types

Explode the HTTP records.

Each HTTP record can contain multiple mime types. These need to be 'exploded' to work with them properly.

​

Figure 4.7. Exploded HTTP Records

Determine where application/x-dosexec originated.

​

Figure 4.8. Suspicious xdosexc

Take a look at the requests for x-dosexc.

​

Figure 4.9. x-dosexc Requests

Determine when the interactions with the suspicious host are occurring.

​

Figure 4.10. When Interactions Occur