Differences

This shows you the differences between two versions of the page.

--- script:x509_ext_c2 [2018/02/08 23:57] – [The Full Text Search FTS Document] veera
+++ script:x509_ext_c2 [2018/02/08 23:59] – [The Full Text Search FTS Document] veera
@@ Line 7: / Line 7: @@
 Detecting this is quite easy with Trisul as well as Bro IDS. This post highlights the different approaches taken.
-===== The Full Text Search FTS Document =====
+===== Trisul vs Bro approaches to the same problem  =====
 Trisul extracts metadata from network traffic and makes them available to LUA Scripts. There are two //streams// your scripts can plug into.
-  - the **Resource** stream:  these are shorter summaries of the meta data. For example the DNS Resources would be one line summary of question and answers
+  - the **Resource** stream:  these are shorter summaries of the meta data. For example the DNS Resources would be one line summary of question and answers. SSL Resources contain the DER format certificate chain.
   - the **FTS** stream: a complete text dump of the meta data. For example : The DNS FTS stream would contain documents with a full dump of all DNS fields - much like the DIG format. Similarly for SSL Certificates, the FTS stream passes text documents that mirror the `openssl x509` command.