Merge pull request #9166 from Security-Onion-Solutions/foxtrot

Merge final protocol analyzers into dev

pillar/zeek/init.sls

@@ -56,6 +56,12 @@ zeek:
       - icsnpp-ethercat
       - icsnpp-enip
       - icsnpp-opcua-binary
+      - icsnpp-bsap
+      - icsnpp-s7comm
+      - zeek-plugin-tds
+      - zeek-plugin-profinet
+      - zeek-spicy-wireguard
+      - zeek-spicy-stun
     '@load-sigs':
       - frameworks/signatures/detect-windows-shells
     redef:

salt/common/tools/sbin/so-zeek-logs

@@ -93,7 +93,21 @@ whiptail_manager_adv_service_zeeklogs() {
   "opcua_binary_browse_response_references" "OPC UA Browse" ON \
   "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
   "opcua_binary_create_subscription" "OPC UA UA Browse" ON \
-  "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3 )
+  "opcua_binary_read" "OPC UA Read" ON \
+  "cotp" "COTP" ON \
+  "s7comm" "S7COMM Header" ON \
+  "s7comm_read_szl" "S7COMM Read-SZL" ON \
+  "s7comm_upload_download" "S7COMM Upoad Download" ON \
+  "s7comm_plus" "S7COMM Plus" ON \
+  "tds" "Tabular Data Streams" ON \
+  "tds_rpc" "TDS RPC" ON \
+  "tds_sql_batch" "TDS SQL" ON \
+  "profinet" "Profinet" ON \
+  "profinet_dce_rpc" "Profinet DCE RPC" ON \
+  "profinet_debug" "Profinet Debug" ON \
+  "stun" "STUN" ON \
+  "stun_nat" "STUN NAT" ON \
+  "wireguard" "Wireguard" ON 3>&1 1>&2 2>&3 )
   
   local exitstatus=$?
 

salt/elasticsearch/files/ingest/zeek.profinet

@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.profinet",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.operation_type",               "target_field": "profinet.operation_type",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.block_version",                  "target_field": "profinet.block_version",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.slot_number",         "target_field": "profinet.slot_number",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.subslot_number",         "target_field": "profinet.subslot_number",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.index",         "target_field": "profinet.index",                     "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.profinet_dce_rpc

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.profinet_dce_rpc",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.version",               "target_field": "profinet.version",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.packet_type",                  "target_field": "profinet.packet_type",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.object_uuid",         "target_field": "profinet.object_uuid",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.interface_uuid",         "target_field": "profinet.interface_uuid",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.activity_uuid",         "target_field": "profinet.activity_uuid",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.server_boot_time",         "target_field": "profinet.server.boot_time",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.operation",         "target_field": "profinet.operation",                     "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.s7comm

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.s7comm",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.rosctr_code",               "target_field": "s7.ros.control.code",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.rosctr_name",                  "target_field": "s7.ros.control.name",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.pdu_reference",         "target_field": "s7.pdu_reference",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.function_code",               "target_field": "s7.function.code",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.function_name",    "target_field": "s7.function.name",        "ignore_missing": true } },
+    { "rename":   { "field": "message2.error_class", "target_field": "s7.error.class",          "ignore_missing": true } },
+    { "rename":   { "field": "message2.error_code",           "target_field": "s7.error.code",               "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.s7comm_plus

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.s7comm_plus",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.version",               "target_field": "s7.version",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.opcode",                  "target_field": "s7.opcode.value",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.opcode_name",         "target_field": "s7.opcode.name",                     "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.stun

@@ -0,0 +1,15 @@
+{
+  "description" : "zeek.stun",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.proto",               "target_field": "network.protocol",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.is_orig",                  "target_field": "stun.is_orig",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.trans_id",         "target_field": "stun.id",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.method",               "target_field": "stun.method",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.class",    "target_field": "stun.clas",        "ignore_missing": true } },
+    { "rename":   { "field": "message2.attr_types", "target_field": "stun.attribute.types",          "ignore_missing": true } },
+    { "rename":   { "field": "message2.attr_vals",           "target_field": "stun.attribute.values",               "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.stun_nat

@@ -0,0 +1,13 @@
+{
+  "description" : "zeek.stun_nat",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.proto",               "target_field": "network.protocol",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.is_orig",                  "target_field": "stun.is_orig",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.wan_addrs",         "target_field": "stun.wan.addresses",                     "ignore_missing": true } },
+    { "rename":   { "field": "message2.wan_ports",               "target_field": "stun.wan.ports",                "ignore_missing": true } },
+    { "rename":   { "field": "message2.lan_addrs",    "target_field": "stun.lan.addresses",        "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

salt/elasticsearch/files/ingest/zeek.wireguard

@@ -0,0 +1,11 @@
+{
+  "description" : "zeek.wireguard",
+  "processors" : [
+    { "remove":   { "field": ["host"],                                                                                          "ignore_failure": true } },
+    { "json":     { "field": "message",			             "target_field": "message2",		                "ignore_failure": true} },
+    { "rename":   { "field": "message2.established",               "target_field": "wireguard.established",                           "ignore_missing": true } },
+    { "rename":   { "field": "message2.initiations",                  "target_field": "wireguard.initiations",                      "ignore_missing": true } },
+    { "rename":   { "field": "message2.responses",         "target_field": "wireguard.respsonses",                     "ignore_missing": true } },
+    { "pipeline": { "name": "zeek.common" } }
+  ]
+}

setup/so-functions

@@ -3057,6 +3057,20 @@ zeek_logs_enabled() {
                         "    - opcua_binary_browse_response_references"\
                         "    - opcua_binary_browse_diagnostic_info"\
                         "    - opcua_binary_create_subscription"\
-                        "    - opcua_binary_read" >> "$zeeklogs_pillar"
+                        "    - opcua_binary_read"\
+			"    - cotp"\
+			"    - s7comm"\
+			"    - s7comm_read_szl"\
+			"    - s7comm_upload_download"\
+			"    - s7comm_plus"\
+			"    - tds"\
+			"    - tds_rpc"\
+			"    - tds_sql_batch"\
+			"    - profinet_dce_rpc"\
+			"    - profinet"\
+			"    - profinet_debug"\
+			"    - stun"\
+			"    - stun_nat"\
+			"    - wireguard" >> "$zeeklogs_pillar"
 	fi
 }

setup/so-whiptail

@@ -1363,7 +1363,21 @@ whiptail_manager_adv_service_zeeklogs() {
         "opcua_binary_browse_response_references" "OPC UA Browse" ON \
         "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
         "opcua_binary_create_subscription" "OPC UA UA Browse" ON \
-        "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3)
+        "opcua_binary_read" "OPC UA Read" ON \
+ 	"cotp" "COTP" ON \
+	"s7comm" "S7COMM Header" ON \
+	"s7comm_read_szl" "S7COMM Read-SZL" ON \
+	"s7comm_upload_download" "S7COMM Upoad Download" ON \
+	"s7comm_plus" "S7COMM Plus" ON \
+	"tds" "Tabular Data Streams" ON \
+	"tds_rpc" "TDS RPC" ON \
+	"tds_sql_batch" "TDS SQL" ON \
+	"profinet" "Profinet" ON \
+	"profinet_dce_rpc" "Profinet DCE RPC" ON \
+	"profinet_debug" "Profinet Debug" ON \
+	"stun" "STUN" ON \
+	"stun_nat" "STUN NAT" ON \
+	"wireguard" "Wireguard" ON 3>&1 1>&2 2>&3)
 
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus