Page History

...

Customer Foo has installed Metron 0.2 and they are using the out-of-the-box data sources (PCAP, YAF/Netflow, Snort, and Bro). They love Metron! But now they want to add a new data source to the platform: Squid proxy logs.

...

1. The proxy events from Squid logs need to be ingested in real-time.
2. The proxy logs must be parsed into a standardized JSON structure that Metron can understand.
3. In real-time, the Squid proxy event needs to be enriched so that the domain names are enriched with the IP information.
4. In real-time, the IP within the proxy event must be checked for threat intel feeds.
5. If there is a threat intel hit, an alert needs to be raised.
6. The system should provide the ability to configure rules via a custom DSL to prioritize/score different types of alerts. - NEW FEATURE in TP2 
7. The end user must be able to see the new telemetry events completely enriched from the new data source. But most importantly, the user should be able to see the alerts prioritized by the high priority with the corresponding contextual data.  NEW FEATURE in TP2
8. All of these requirements will need to be implemented easily without writing any new Java code.

But wait....Customer Foo still wants more.  Customer Foo wants to extract intelligence from the Squid telemetry stream and apply this intelligence in real-time to the threat triaging function.  

What is Squid?

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-requested web pages. For more information on Squid see Squid-cache.org.

...