The following TQL queries are Bro Conn queries.
Identify top talkers including internal to internal
class:bro_conn NOT (srcisp:"private ip address lan" AND dstisp:"private ip address lan") | groupby srcipv4
Identify pairs of top talkers
class:bro_conn NOT (srcisp:"private ip address lan" AND dstisp:"private ip address lan") | groupby [srcipv4,dstipv4]
Identify top talkers (outbound only)
class:bro_conn (srcisp:"YOUR COMPANY ISP NAME" OR srcisp:"private ip address lan") not dstisp:"YOUR COMPANY ISP NAME" not dstisp:"private ip address lan" | groupby srcipv4
Identify top talkers (inbound only)
class:bro_conn not srcisp:"YOUR COMPANY ISP NAME" not srcisp:"private ip address lan" (dstisp:"YOUR COMPANY ISP NAME" OR dstisp:"private ip address lan") | groupby srcipv4
Identify non-standard port usage (will vary based on each client environment)
class:bro_conn not dstport:["22","9100","88","389","636","53","137","138","445","123","67","68","500","80","8080","514","443","161","162","1434","5060","5061","5062","1985"] not protocol:icmp | groupby [srcport,dstport]
Identify ICMP traffic
class:bro_conn protocol:icmp | groupby [srcport,dstport]
Identify Citrix connections grouped by country of origin
class:bro_conn dstipv4:$external_citrix_servers connstate:"sf" | groupby srccountry 200
Identify Citrix connections grouped by source ISP
class:bro_conn dstipv4:$external_citrix_servers connstate:"sf" | groupby srcisp 200
Identify Citrix connections originating from Russia, China, Ireland and grouped by duration, received bytes, and destination port
class:bro_conn dstipv4:$external_citrix_servers srccountrycode:[ru,cn,ir] connstate:"sf" | groupby [duration,rcvdipbytes,dstport] 200
Identify file transfers from outside to inside over ports 80, 443, 8080
class:bro_conn dstisp:"target corporation" dstport:80 !srcisp:["private ip address lan","<target corporation>"] connstate:sf rcvdbytes:[10,1000000] | groupby srcdomain