Announcing Trisul Apps

Announcing Trisul Apps

Hey ! Trisul users. We’re excited to announce Trisul Apps

Its a collection of plugin extensions you can install,upgrade,remove with a single click to enhance the capabilites of Trisul.

We’re launching with 8 apps. You can hope to see dozens more in the coming weeks. All apps are open source and use the Lua or the JavaScript-TRP API. You can write your own apps or customize these.

App types

Trisul Apps fall into three categories

  1. Analytics — Using the Trisul LUA API adds custom analysis capabilities
  2. JS/D3 Dashboards — Uses the JavaScript/TRP API to visualize historical data
  3. Packaged Dashboard — Dashboards, modules, new counters, flow trackers, exported from Trisul

We’ve got the following apps live now.

nametypedesc
Passive DNS ExtractorLuaWatches DNS stream and builds a LevelDB database containing an IP→Domain history database
Prune YouTube/Netflix/FBLuaUsing the Passive DNS app to detect HTTPS and QUIC streams to YouTube, NetFlix, Facebook, video. Save 40-50% on disk space
Prune TLSLuaAnother Prune app designed to optimize packet storage. Cut out all TLS traffic from being stored, but stores non TLS traffic on port 443. Looks for SSL/TLS handshake
SNI meteringLuaGain visibility into TLS traffic. Breakup of traffic and connections by SNI (Server Name)
SSH eventsLuaSolid detection of SSH login events, reverse SSH tunnel. Technique explained in SSH Traffic Analysis
Save BinariesLuaSave all suspicious files transferred over HTTP. Uses the file type as detected by libmagic rather than trusting the Content-Type. No size limit.
HeatmapD3/JSFor any metric generate a hourly heatmap instantly for the past week. Click on a cell to drilldown into any interval
Super Search HostD3/JSType a hostname ; eg google to retreive all IPs associated with that for each IP show traffic in last 24 hours
Perf StatsDashboardA sample dashboard showing Trisul performance. Packet drops, packet processed, stream flush time, CPU, memory etc

These apps have added real value to the sites we have deployed them. We will be explaining each of these apps in detail shortly.

Trisul Apps are available even to those using the Free License. Do try them out.

Free Download Trisul 6.0 ! Ready to go packages for Ubuntu and CentOS.

Leave a Reply

Your email address will not be published. Required fields are marked *