diff --git a/pillar/zeek/init.sls b/pillar/zeek/init.sls index a522a02cb..7b306e7fe 100644 --- a/pillar/zeek/init.sls +++ b/pillar/zeek/init.sls @@ -56,6 +56,12 @@ zeek: - icsnpp-ethercat - icsnpp-enip - icsnpp-opcua-binary + - icsnpp-bsap + - icsnpp-s7comm + - zeek-plugin-tds + - zeek-plugin-profinet + - zeek-spicy-wireguard + - zeek-spicy-stun '@load-sigs': - frameworks/signatures/detect-windows-shells redef: diff --git a/salt/common/tools/sbin/so-zeek-logs b/salt/common/tools/sbin/so-zeek-logs index 4f56ee7e5..e4c8c7d7a 100755 --- a/salt/common/tools/sbin/so-zeek-logs +++ b/salt/common/tools/sbin/so-zeek-logs @@ -93,7 +93,21 @@ whiptail_manager_adv_service_zeeklogs() { "opcua_binary_browse_response_references" "OPC UA Browse" ON \ "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \ "opcua_binary_create_subscription" "OPC UA UA Browse" ON \ - "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3 ) + "opcua_binary_read" "OPC UA Read" ON \ + "cotp" "COTP" ON \ + "s7comm" "S7COMM Header" ON \ + "s7comm_read_szl" "S7COMM Read-SZL" ON \ + "s7comm_upload_download" "S7COMM Upoad Download" ON \ + "s7comm_plus" "S7COMM Plus" ON \ + "tds" "Tabular Data Streams" ON \ + "tds_rpc" "TDS RPC" ON \ + "tds_sql_batch" "TDS SQL" ON \ + "profinet" "Profinet" ON \ + "profinet_dce_rpc" "Profinet DCE RPC" ON \ + "profinet_debug" "Profinet Debug" ON \ + "stun" "STUN" ON \ + "stun_nat" "STUN NAT" ON \ + "wireguard" "Wireguard" ON 3>&1 1>&2 2>&3 ) local exitstatus=$? diff --git a/salt/elasticsearch/files/ingest/zeek.profinet b/salt/elasticsearch/files/ingest/zeek.profinet new file mode 100644 index 000000000..e9d69c0dc --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.profinet @@ -0,0 +1,13 @@ +{ + "description" : "zeek.profinet", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.operation_type", "target_field": "profinet.operation_type", "ignore_missing": true } }, + { "rename": { "field": "message2.block_version", "target_field": "profinet.block_version", "ignore_missing": true } }, + { "rename": { "field": "message2.slot_number", "target_field": "profinet.slot_number", "ignore_missing": true } }, + { "rename": { "field": "message2.subslot_number", "target_field": "profinet.subslot_number", "ignore_missing": true } }, + { "rename": { "field": "message2.index", "target_field": "profinet.index", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc b/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc new file mode 100644 index 000000000..e89fd7d95 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc @@ -0,0 +1,15 @@ +{ + "description" : "zeek.profinet_dce_rpc", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.version", "target_field": "profinet.version", "ignore_missing": true } }, + { "rename": { "field": "message2.packet_type", "target_field": "profinet.packet_type", "ignore_missing": true } }, + { "rename": { "field": "message2.object_uuid", "target_field": "profinet.object_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.interface_uuid", "target_field": "profinet.interface_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.activity_uuid", "target_field": "profinet.activity_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.server_boot_time", "target_field": "profinet.server.boot_time", "ignore_missing": true } }, + { "rename": { "field": "message2.operation", "target_field": "profinet.operation", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm b/salt/elasticsearch/files/ingest/zeek.s7comm new file mode 100644 index 000000000..646c6bec3 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.s7comm @@ -0,0 +1,15 @@ +{ + "description" : "zeek.s7comm", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } }, + { "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } }, + { "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } }, + { "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } }, + { "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } }, + { "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm_plus b/salt/elasticsearch/files/ingest/zeek.s7comm_plus new file mode 100644 index 000000000..a6acd1b35 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.s7comm_plus @@ -0,0 +1,11 @@ +{ + "description" : "zeek.s7comm_plus", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.stun b/salt/elasticsearch/files/ingest/zeek.stun new file mode 100644 index 000000000..f5e7d1baf --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.stun @@ -0,0 +1,15 @@ +{ + "description" : "zeek.stun", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.trans_id", "target_field": "stun.id", "ignore_missing": true } }, + { "rename": { "field": "message2.method", "target_field": "stun.method", "ignore_missing": true } }, + { "rename": { "field": "message2.class", "target_field": "stun.clas", "ignore_missing": true } }, + { "rename": { "field": "message2.attr_types", "target_field": "stun.attribute.types", "ignore_missing": true } }, + { "rename": { "field": "message2.attr_vals", "target_field": "stun.attribute.values", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.stun_nat b/salt/elasticsearch/files/ingest/zeek.stun_nat new file mode 100644 index 000000000..45f9b3055 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.stun_nat @@ -0,0 +1,13 @@ +{ + "description" : "zeek.stun_nat", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.wan_addrs", "target_field": "stun.wan.addresses", "ignore_missing": true } }, + { "rename": { "field": "message2.wan_ports", "target_field": "stun.wan.ports", "ignore_missing": true } }, + { "rename": { "field": "message2.lan_addrs", "target_field": "stun.lan.addresses", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.wireguard b/salt/elasticsearch/files/ingest/zeek.wireguard new file mode 100644 index 000000000..ac8e56964 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.wireguard @@ -0,0 +1,11 @@ +{ + "description" : "zeek.wireguard", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } }, + { "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } }, + { "rename": { "field": "message2.responses", "target_field": "wireguard.respsonses", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/setup/so-functions b/setup/so-functions index b5bc1a8f8..761f3875d 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -3057,6 +3057,20 @@ zeek_logs_enabled() { " - opcua_binary_browse_response_references"\ " - opcua_binary_browse_diagnostic_info"\ " - opcua_binary_create_subscription"\ - " - opcua_binary_read" >> "$zeeklogs_pillar" + " - opcua_binary_read"\ + " - cotp"\ + " - s7comm"\ + " - s7comm_read_szl"\ + " - s7comm_upload_download"\ + " - s7comm_plus"\ + " - tds"\ + " - tds_rpc"\ + " - tds_sql_batch"\ + " - profinet_dce_rpc"\ + " - profinet"\ + " - profinet_debug"\ + " - stun"\ + " - stun_nat"\ + " - wireguard" >> "$zeeklogs_pillar" fi } diff --git a/setup/so-whiptail b/setup/so-whiptail index e7d5e4507..db7345227 100755 --- a/setup/so-whiptail +++ b/setup/so-whiptail @@ -1363,7 +1363,21 @@ whiptail_manager_adv_service_zeeklogs() { "opcua_binary_browse_response_references" "OPC UA Browse" ON \ "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \ "opcua_binary_create_subscription" "OPC UA UA Browse" ON \ - "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3) + "opcua_binary_read" "OPC UA Read" ON \ + "cotp" "COTP" ON \ + "s7comm" "S7COMM Header" ON \ + "s7comm_read_szl" "S7COMM Read-SZL" ON \ + "s7comm_upload_download" "S7COMM Upoad Download" ON \ + "s7comm_plus" "S7COMM Plus" ON \ + "tds" "Tabular Data Streams" ON \ + "tds_rpc" "TDS RPC" ON \ + "tds_sql_batch" "TDS SQL" ON \ + "profinet" "Profinet" ON \ + "profinet_dce_rpc" "Profinet DCE RPC" ON \ + "profinet_debug" "Profinet Debug" ON \ + "stun" "STUN" ON \ + "stun_nat" "STUN NAT" ON \ + "wireguard" "Wireguard" ON 3>&1 1>&2 2>&3) local exitstatus=$? whiptail_check_exitstatus $exitstatus