CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9166 from Security-Onion-Solutions/foxtrot

Browse Source 
Merge final protocol analyzers into dev
This commit is contained in:
weslambert
2022-11-18 08:41:43 -05:00
committed by GitHub
parent 7319cb07e2 a28e5de5f4
commit 089b403a3b
11 changed files with 144 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pillar/zeek/init.sls
View File

@@ -56,6 +56,12 @@ zeek:
- icsnpp-ethercat
- icsnpp-enip
- icsnpp-opcua-binary
- icsnpp-bsap
- icsnpp-s7comm
- zeek-plugin-tds
- zeek-plugin-profinet
- zeek-spicy-wireguard
- zeek-spicy-stun
'@load-sigs':
- frameworks/signatures/detect-windows-shells
redef:

16
salt/common/tools/sbin/so-zeek-logs
View File

@@ -93,7 +93,21 @@ whiptail_manager_adv_service_zeeklogs() {
"opcua_binary_browse_response_references" "OPC UA Browse" ON \
"opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
"opcua_binary_create_subscription" "OPC UA UA Browse" ON \
"opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3 )
"opcua_binary_read" "OPC UA Read" ON \
"cotp" "COTP" ON \
"s7comm" "S7COMM Header" ON \
"s7comm_read_szl" "S7COMM Read-SZL" ON \
"s7comm_upload_download" "S7COMM Upoad Download" ON \
"s7comm_plus" "S7COMM Plus" ON \
"tds" "Tabular Data Streams" ON \
"tds_rpc" "TDS RPC" ON \
"tds_sql_batch" "TDS SQL" ON \
"profinet" "Profinet" ON \
"profinet_dce_rpc" "Profinet DCE RPC" ON \
"profinet_debug" "Profinet Debug" ON \
"stun" "STUN" ON \
"stun_nat" "STUN NAT" ON \
"wireguard" "Wireguard" ON 3>&1 1>&2 2>&3 )
local exitstatus=$?

13
salt/elasticsearch/files/ingest/zeek.profinet Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.profinet",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.operation_type", "target_field": "profinet.operation_type", "ignore_missing": true } },
{ "rename": { "field": "message2.block_version", "target_field": "profinet.block_version", "ignore_missing": true } },
{ "rename": { "field": "message2.slot_number", "target_field": "profinet.slot_number", "ignore_missing": true } },
{ "rename": { "field": "message2.subslot_number", "target_field": "profinet.subslot_number", "ignore_missing": true } },
{ "rename": { "field": "message2.index", "target_field": "profinet.index", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.profinet_dce_rpc",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.version", "target_field": "profinet.version", "ignore_missing": true } },
{ "rename": { "field": "message2.packet_type", "target_field": "profinet.packet_type", "ignore_missing": true } },
{ "rename": { "field": "message2.object_uuid", "target_field": "profinet.object_uuid", "ignore_missing": true } },
{ "rename": { "field": "message2.interface_uuid", "target_field": "profinet.interface_uuid", "ignore_missing": true } },
{ "rename": { "field": "message2.activity_uuid", "target_field": "profinet.activity_uuid", "ignore_missing": true } },
{ "rename": { "field": "message2.server_boot_time", "target_field": "profinet.server.boot_time", "ignore_missing": true } },
{ "rename": { "field": "message2.operation", "target_field": "profinet.operation", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.s7comm Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.s7comm",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } },
{ "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } },
{ "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } },
{ "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } },
{ "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } },
{ "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } },
{ "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.s7comm_plus Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.s7comm_plus",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } },
{ "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

15
salt/elasticsearch/files/ingest/zeek.stun Normal file
View File

@@ -0,0 +1,15 @@
{
"description" : "zeek.stun",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.trans_id", "target_field": "stun.id", "ignore_missing": true } },
{ "rename": { "field": "message2.method", "target_field": "stun.method", "ignore_missing": true } },
{ "rename": { "field": "message2.class", "target_field": "stun.clas", "ignore_missing": true } },
{ "rename": { "field": "message2.attr_types", "target_field": "stun.attribute.types", "ignore_missing": true } },
{ "rename": { "field": "message2.attr_vals", "target_field": "stun.attribute.values", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

13
salt/elasticsearch/files/ingest/zeek.stun_nat Normal file
View File

@@ -0,0 +1,13 @@
{
"description" : "zeek.stun_nat",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } },
{ "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.wan_addrs", "target_field": "stun.wan.addresses", "ignore_missing": true } },
{ "rename": { "field": "message2.wan_ports", "target_field": "stun.wan.ports", "ignore_missing": true } },
{ "rename": { "field": "message2.lan_addrs", "target_field": "stun.lan.addresses", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

11
salt/elasticsearch/files/ingest/zeek.wireguard Normal file
View File

@@ -0,0 +1,11 @@
{
"description" : "zeek.wireguard",
"processors" : [
{ "remove": { "field": ["host"], "ignore_failure": true } },
{ "json": { "field": "message", "target_field": "message2", "ignore_failure": true} },
{ "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } },
{ "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } },
{ "rename": { "field": "message2.responses", "target_field": "wireguard.respsonses", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }
]
}

16
setup/so-functions
View File

@@ -3057,6 +3057,20 @@ zeek_logs_enabled() {
" - opcua_binary_browse_response_references"\
" - opcua_binary_browse_diagnostic_info"\
" - opcua_binary_create_subscription"\
" - opcua_binary_read" >> "$zeeklogs_pillar"
" - opcua_binary_read"\
" - cotp"\
" - s7comm"\
" - s7comm_read_szl"\
" - s7comm_upload_download"\
" - s7comm_plus"\
" - tds"\
" - tds_rpc"\
" - tds_sql_batch"\
" - profinet_dce_rpc"\
" - profinet"\
" - profinet_debug"\
" - stun"\
" - stun_nat"\
" - wireguard" >> "$zeeklogs_pillar"
fi
}

16
setup/so-whiptail
View File

@@ -1363,7 +1363,21 @@ whiptail_manager_adv_service_zeeklogs() {
"opcua_binary_browse_response_references" "OPC UA Browse" ON \
"opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
"opcua_binary_create_subscription" "OPC UA UA Browse" ON \
"opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3)
"opcua_binary_read" "OPC UA Read" ON \
"cotp" "COTP" ON \
"s7comm" "S7COMM Header" ON \
"s7comm_read_szl" "S7COMM Read-SZL" ON \
"s7comm_upload_download" "S7COMM Upoad Download" ON \
"s7comm_plus" "S7COMM Plus" ON \
"tds" "Tabular Data Streams" ON \
"tds_rpc" "TDS RPC" ON \
"tds_sql_batch" "TDS SQL" ON \
"profinet" "Profinet" ON \
"profinet_dce_rpc" "Profinet DCE RPC" ON \
"profinet_debug" "Profinet Debug" ON \
"stun" "STUN" ON \
"stun_nat" "STUN NAT" ON \
"wireguard" "Wireguard" ON 3>&1 1>&2 2>&3)
local exitstatus=$?
whiptail_check_exitstatus $exitstatus