From d890f75ccabd8f7d3e3473d8641aeeb84e855557 Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Fri, 11 Nov 2022 13:59:20 -0800 Subject: [PATCH 1/7] Correct typo --- pillar/zeek/init.sls | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pillar/zeek/init.sls b/pillar/zeek/init.sls index 21b7e61ae..a522a02cb 100644 --- a/pillar/zeek/init.sls +++ b/pillar/zeek/init.sls @@ -55,7 +55,7 @@ zeek: - icsnpp-bacnet - icsnpp-ethercat - icsnpp-enip - - icsnpp-ocpua-binary + - icsnpp-opcua-binary '@load-sigs': - frameworks/signatures/detect-windows-shells redef: From 1b8e5460456406d61f92de7f439999e1640f6899 Mon Sep 17 00:00:00 2001 From: lock-wire Date: Wed, 16 Nov 2022 21:41:02 -0600 Subject: [PATCH 2/7] Add s7comm,tds,stun,profinet,wireguard --- pillar/zeek/init.sls | 5 +++++ salt/common/tools/sbin/so-zeek-logs | 16 +++++++++++++++- setup/so-functions | 18 ++++++++++++++++-- setup/so-whiptail | 16 +++++++++++++++- 4 files changed, 51 insertions(+), 4 deletions(-) diff --git a/pillar/zeek/init.sls b/pillar/zeek/init.sls index a522a02cb..43f28af22 100644 --- a/pillar/zeek/init.sls +++ b/pillar/zeek/init.sls @@ -56,6 +56,11 @@ zeek: - icsnpp-ethercat - icsnpp-enip - icsnpp-opcua-binary + - icsnpp-s7comm + - zeek-plugin-tds + - zeek-plugin-profinet + - zeek-spicy-wireguard + - zeek-spicy-stun '@load-sigs': - frameworks/signatures/detect-windows-shells redef: diff --git a/salt/common/tools/sbin/so-zeek-logs b/salt/common/tools/sbin/so-zeek-logs index 4f56ee7e5..e4c8c7d7a 100755 --- a/salt/common/tools/sbin/so-zeek-logs +++ b/salt/common/tools/sbin/so-zeek-logs @@ -93,7 +93,21 @@ whiptail_manager_adv_service_zeeklogs() { "opcua_binary_browse_response_references" "OPC UA Browse" ON \ "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \ "opcua_binary_create_subscription" "OPC UA UA Browse" ON \ - "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3 ) + "opcua_binary_read" "OPC UA Read" ON \ + "cotp" "COTP" ON \ + "s7comm" "S7COMM Header" ON \ + "s7comm_read_szl" "S7COMM Read-SZL" ON \ + "s7comm_upload_download" "S7COMM Upoad Download" ON \ + "s7comm_plus" "S7COMM Plus" ON \ + "tds" "Tabular Data Streams" ON \ + "tds_rpc" "TDS RPC" ON \ + "tds_sql_batch" "TDS SQL" ON \ + "profinet" "Profinet" ON \ + "profinet_dce_rpc" "Profinet DCE RPC" ON \ + "profinet_debug" "Profinet Debug" ON \ + "stun" "STUN" ON \ + "stun_nat" "STUN NAT" ON \ + "wireguard" "Wireguard" ON 3>&1 1>&2 2>&3 ) local exitstatus=$? diff --git a/setup/so-functions b/setup/so-functions index 85032e275..062e4ccad 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -3020,7 +3020,7 @@ zeek_logs_enabled() { " - modbus_read_write_multiple_registers"\ " - bacnet"\ " - bacnet_discovery"\ - " - bacnet_property" + " - bacnet_property"\ " - ecat_registers"\ " - ecat_log_address"\ " - ecat_dev_info"\ @@ -3057,6 +3057,20 @@ zeek_logs_enabled() { " - opcua_binary_browse_response_references"\ " - opcua_binary_browse_diagnostic_info"\ " - opcua_binary_create_subscription"\ - " - opcua_binary_read" >> "$zeeklogs_pillar" + " - opcua_binary_read" + " - cotp"\ + " - s7comm"\ + " - s7comm_read_szl"\ + " - s7comm_upload_download"\ + " - s7comm_plus"\ + " - tds"\ + " - tds_rpc"\ + " - tds_sql_batch"\ + " - profinet_dce_rpc"\ + " - profinet"\ + " - profinet_debug"\ + " - stun"\ + " - stun_nat"\ + " - wireguard" >> "$zeeklogs_pillar" fi } diff --git a/setup/so-whiptail b/setup/so-whiptail index e7d5e4507..db7345227 100755 --- a/setup/so-whiptail +++ b/setup/so-whiptail @@ -1363,7 +1363,21 @@ whiptail_manager_adv_service_zeeklogs() { "opcua_binary_browse_response_references" "OPC UA Browse" ON \ "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \ "opcua_binary_create_subscription" "OPC UA UA Browse" ON \ - "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3) + "opcua_binary_read" "OPC UA Read" ON \ + "cotp" "COTP" ON \ + "s7comm" "S7COMM Header" ON \ + "s7comm_read_szl" "S7COMM Read-SZL" ON \ + "s7comm_upload_download" "S7COMM Upoad Download" ON \ + "s7comm_plus" "S7COMM Plus" ON \ + "tds" "Tabular Data Streams" ON \ + "tds_rpc" "TDS RPC" ON \ + "tds_sql_batch" "TDS SQL" ON \ + "profinet" "Profinet" ON \ + "profinet_dce_rpc" "Profinet DCE RPC" ON \ + "profinet_debug" "Profinet Debug" ON \ + "stun" "STUN" ON \ + "stun_nat" "STUN NAT" ON \ + "wireguard" "Wireguard" ON 3>&1 1>&2 2>&3) local exitstatus=$? whiptail_check_exitstatus $exitstatus From a27819403782f7bef80a5659f5605f4338b3c008 Mon Sep 17 00:00:00 2001 From: Wes Date: Thu, 17 Nov 2022 16:16:33 +0000 Subject: [PATCH 3/7] Add additional ICS/SCADA ingest node pipelines --- salt/elasticsearch/files/ingest/zeek.profinet | 13 +++++++++++++ .../files/ingest/zeek.profinet_dce_rpc | 15 +++++++++++++++ salt/elasticsearch/files/ingest/zeek.s7comm | 15 +++++++++++++++ salt/elasticsearch/files/ingest/zeek.s7comm_plus | 11 +++++++++++ salt/elasticsearch/files/ingest/zeek.stun | 15 +++++++++++++++ salt/elasticsearch/files/ingest/zeek.stun_nat | 13 +++++++++++++ salt/elasticsearch/files/ingest/zeek.wireguard | 11 +++++++++++ 7 files changed, 93 insertions(+) create mode 100644 salt/elasticsearch/files/ingest/zeek.profinet create mode 100644 salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc create mode 100644 salt/elasticsearch/files/ingest/zeek.s7comm create mode 100644 salt/elasticsearch/files/ingest/zeek.s7comm_plus create mode 100644 salt/elasticsearch/files/ingest/zeek.stun create mode 100644 salt/elasticsearch/files/ingest/zeek.stun_nat create mode 100644 salt/elasticsearch/files/ingest/zeek.wireguard diff --git a/salt/elasticsearch/files/ingest/zeek.profinet b/salt/elasticsearch/files/ingest/zeek.profinet new file mode 100644 index 000000000..e9d69c0dc --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.profinet @@ -0,0 +1,13 @@ +{ + "description" : "zeek.profinet", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.operation_type", "target_field": "profinet.operation_type", "ignore_missing": true } }, + { "rename": { "field": "message2.block_version", "target_field": "profinet.block_version", "ignore_missing": true } }, + { "rename": { "field": "message2.slot_number", "target_field": "profinet.slot_number", "ignore_missing": true } }, + { "rename": { "field": "message2.subslot_number", "target_field": "profinet.subslot_number", "ignore_missing": true } }, + { "rename": { "field": "message2.index", "target_field": "profinet.index", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc b/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc new file mode 100644 index 000000000..e89fd7d95 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc @@ -0,0 +1,15 @@ +{ + "description" : "zeek.profinet_dce_rpc", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.version", "target_field": "profinet.version", "ignore_missing": true } }, + { "rename": { "field": "message2.packet_type", "target_field": "profinet.packet_type", "ignore_missing": true } }, + { "rename": { "field": "message2.object_uuid", "target_field": "profinet.object_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.interface_uuid", "target_field": "profinet.interface_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.activity_uuid", "target_field": "profinet.activity_uuid", "ignore_missing": true } }, + { "rename": { "field": "message2.server_boot_time", "target_field": "profinet.server.boot_time", "ignore_missing": true } }, + { "rename": { "field": "message2.operation", "target_field": "profinet.operation", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm b/salt/elasticsearch/files/ingest/zeek.s7comm new file mode 100644 index 000000000..646c6bec3 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.s7comm @@ -0,0 +1,15 @@ +{ + "description" : "zeek.s7comm", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.rosctr_code", "target_field": "s7.ros.control.code", "ignore_missing": true } }, + { "rename": { "field": "message2.rosctr_name", "target_field": "s7.ros.control.name", "ignore_missing": true } }, + { "rename": { "field": "message2.pdu_reference", "target_field": "s7.pdu_reference", "ignore_missing": true } }, + { "rename": { "field": "message2.function_code", "target_field": "s7.function.code", "ignore_missing": true } }, + { "rename": { "field": "message2.function_name", "target_field": "s7.function.name", "ignore_missing": true } }, + { "rename": { "field": "message2.error_class", "target_field": "s7.error.class", "ignore_missing": true } }, + { "rename": { "field": "message2.error_code", "target_field": "s7.error.code", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.s7comm_plus b/salt/elasticsearch/files/ingest/zeek.s7comm_plus new file mode 100644 index 000000000..a6acd1b35 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.s7comm_plus @@ -0,0 +1,11 @@ +{ + "description" : "zeek.s7comm_plus", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.version", "target_field": "s7.version", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode", "target_field": "s7.opcode.value", "ignore_missing": true } }, + { "rename": { "field": "message2.opcode_name", "target_field": "s7.opcode.name", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.stun b/salt/elasticsearch/files/ingest/zeek.stun new file mode 100644 index 000000000..f5e7d1baf --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.stun @@ -0,0 +1,15 @@ +{ + "description" : "zeek.stun", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.trans_id", "target_field": "stun.id", "ignore_missing": true } }, + { "rename": { "field": "message2.method", "target_field": "stun.method", "ignore_missing": true } }, + { "rename": { "field": "message2.class", "target_field": "stun.clas", "ignore_missing": true } }, + { "rename": { "field": "message2.attr_types", "target_field": "stun.attribute.types", "ignore_missing": true } }, + { "rename": { "field": "message2.attr_vals", "target_field": "stun.attribute.values", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.stun_nat b/salt/elasticsearch/files/ingest/zeek.stun_nat new file mode 100644 index 000000000..45f9b3055 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.stun_nat @@ -0,0 +1,13 @@ +{ + "description" : "zeek.stun_nat", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.proto", "target_field": "network.protocol", "ignore_missing": true } }, + { "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } }, + { "rename": { "field": "message2.wan_addrs", "target_field": "stun.wan.addresses", "ignore_missing": true } }, + { "rename": { "field": "message2.wan_ports", "target_field": "stun.wan.ports", "ignore_missing": true } }, + { "rename": { "field": "message2.lan_addrs", "target_field": "stun.lan.addresses", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} diff --git a/salt/elasticsearch/files/ingest/zeek.wireguard b/salt/elasticsearch/files/ingest/zeek.wireguard new file mode 100644 index 000000000..ac8e56964 --- /dev/null +++ b/salt/elasticsearch/files/ingest/zeek.wireguard @@ -0,0 +1,11 @@ +{ + "description" : "zeek.wireguard", + "processors" : [ + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true} }, + { "rename": { "field": "message2.established", "target_field": "wireguard.established", "ignore_missing": true } }, + { "rename": { "field": "message2.initiations", "target_field": "wireguard.initiations", "ignore_missing": true } }, + { "rename": { "field": "message2.responses", "target_field": "wireguard.respsonses", "ignore_missing": true } }, + { "pipeline": { "name": "zeek.common" } } + ] +} From 78bc2a95e5dc55d50ef27916e6f2abb54846c362 Mon Sep 17 00:00:00 2001 From: weslambert Date: Thu, 17 Nov 2022 11:20:24 -0500 Subject: [PATCH 4/7] Add icsnpp-bsap to enabled plugins --- pillar/zeek/init.sls | 1 + 1 file changed, 1 insertion(+) diff --git a/pillar/zeek/init.sls b/pillar/zeek/init.sls index 43f28af22..75841730c 100644 --- a/pillar/zeek/init.sls +++ b/pillar/zeek/init.sls @@ -53,6 +53,7 @@ zeek: - icsnpp-modbus - icsnpp-dnp3 - icsnpp-bacnet + - icsnpp-bsap - icsnpp-ethercat - icsnpp-enip - icsnpp-opcua-binary From 13b6b43324145d5525ff8fc9196bd140852375f9 Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Thu, 17 Nov 2022 10:42:21 -0600 Subject: [PATCH 5/7] Update init.sls --- pillar/zeek/init.sls | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pillar/zeek/init.sls b/pillar/zeek/init.sls index 75841730c..a522a02cb 100644 --- a/pillar/zeek/init.sls +++ b/pillar/zeek/init.sls @@ -53,15 +53,9 @@ zeek: - icsnpp-modbus - icsnpp-dnp3 - icsnpp-bacnet - - icsnpp-bsap - icsnpp-ethercat - icsnpp-enip - icsnpp-opcua-binary - - icsnpp-s7comm - - zeek-plugin-tds - - zeek-plugin-profinet - - zeek-spicy-wireguard - - zeek-spicy-stun '@load-sigs': - frameworks/signatures/detect-windows-shells redef: From 2e30cefd91169655c80b2947ea2fbe3250f5a07e Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Thu, 17 Nov 2022 10:47:00 -0600 Subject: [PATCH 6/7] Add remaining protocol parsers - icsnpp-bsap - icsnpp-s7comm - zeek-plugin-tds - zeek-plugin-profinet - zeek-spicy-wireguard - zeek-spicy-stun --- pillar/zeek/init.sls | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pillar/zeek/init.sls b/pillar/zeek/init.sls index a522a02cb..7b306e7fe 100644 --- a/pillar/zeek/init.sls +++ b/pillar/zeek/init.sls @@ -56,6 +56,12 @@ zeek: - icsnpp-ethercat - icsnpp-enip - icsnpp-opcua-binary + - icsnpp-bsap + - icsnpp-s7comm + - zeek-plugin-tds + - zeek-plugin-profinet + - zeek-spicy-wireguard + - zeek-spicy-stun '@load-sigs': - frameworks/signatures/detect-windows-shells redef: From a28e5de5f4fbcf5faa0ae132d10ea0cf936027c0 Mon Sep 17 00:00:00 2001 From: Peter Di Giorgio <16980376+lock-wire@users.noreply.github.com> Date: Fri, 18 Nov 2022 06:29:57 -0600 Subject: [PATCH 7/7] Correct trailing \ --- setup/so-functions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup/so-functions b/setup/so-functions index bd48d3fc5..761f3875d 100755 --- a/setup/so-functions +++ b/setup/so-functions @@ -3057,7 +3057,7 @@ zeek_logs_enabled() { " - opcua_binary_browse_response_references"\ " - opcua_binary_browse_diagnostic_info"\ " - opcua_binary_create_subscription"\ - " - opcua_binary_read" + " - opcua_binary_read"\ " - cotp"\ " - s7comm"\ " - s7comm_read_szl"\