Update CapME with a new option to query Bro conn.log via ELSA

[GoogleCodeExporter]

- Extend Bro's conn.log to include the name of the Bro worker that saw 
the connection (HOSTNAME-INTERFACE). 
- Extend CapMe to query the ELSA API (instead of the Sguil sancp 
table) for the src/dst IP/port and parse the name of the worker out of 
the result. 
- CapMe then submits a cliscript request to the pcap_agent with the 
same name as the Bro worker (HOSTNAME-INTERFACE) to retrieve the 
transcript. 

https://groups.google.com/d/topic/security-onion/CpsJKY9yC04/discussion

Original issue reported on code.google.com by doug.bu...@gmail.com on 19 Jun 2013 at 2:11

[GoogleCodeExporter]

Submitted to testers.

Original comment by doug.bu...@gmail.com on 4 Jul 2013 at 10:50

• Changed state: Started
• Added labels: ****
• Removed labels: ****

[GoogleCodeExporter]

Tested by:
Matt Gregory
David Zawdie
Michal Purzynski

Original comment by doug.bu...@gmail.com on 11 Jul 2013 at 10:21

• Added labels: ****
• Removed labels: ****

[GoogleCodeExporter]

Published:
http://securityonion.blogspot.com/2013/07/new-securityonion-bro-scripts-and.html

Original comment by doug.bu...@gmail.com on 11 Jul 2013 at 11:24

• Changed state: Verified
• Added labels: ****
• Removed labels: ****