Add s7comm,tds,stun,profinet,wireguard

pillar/zeek/init.sls

@@ -56,6 +56,11 @@ zeek:
       - icsnpp-ethercat
       - icsnpp-enip
       - icsnpp-opcua-binary
+      - icsnpp-s7comm
+      - zeek-plugin-tds
+      - zeek-plugin-profinet
+      - zeek-spicy-wireguard
+      - zeek-spicy-stun
     '@load-sigs':
       - frameworks/signatures/detect-windows-shells
     redef:

salt/common/tools/sbin/so-zeek-logs

@@ -93,7 +93,21 @@ whiptail_manager_adv_service_zeeklogs() {
   "opcua_binary_browse_response_references" "OPC UA Browse" ON \
   "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
   "opcua_binary_create_subscription" "OPC UA UA Browse" ON \
-  "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3 )
+  "opcua_binary_read" "OPC UA Read" ON \
+  "cotp" "COTP" ON \
+  "s7comm" "S7COMM Header" ON \
+  "s7comm_read_szl" "S7COMM Read-SZL" ON \
+  "s7comm_upload_download" "S7COMM Upoad Download" ON \
+  "s7comm_plus" "S7COMM Plus" ON \
+  "tds" "Tabular Data Streams" ON \
+  "tds_rpc" "TDS RPC" ON \
+  "tds_sql_batch" "TDS SQL" ON \
+  "profinet" "Profinet" ON \
+  "profinet_dce_rpc" "Profinet DCE RPC" ON \
+  "profinet_debug" "Profinet Debug" ON \
+  "stun" "STUN" ON \
+  "stun_nat" "STUN NAT" ON \
+  "wireguard" "Wireguard" ON 3>&1 1>&2 2>&3 )
   
   local exitstatus=$?
 

setup/so-functions

@@ -3020,7 +3020,7 @@ zeek_logs_enabled() {
 			"    - modbus_read_write_multiple_registers"\
 			"    - bacnet"\
 			"    - bacnet_discovery"\
-			"    - bacnet_property"
+			"    - bacnet_property"\
 			"    - ecat_registers"\
                         "    - ecat_log_address"\
                         "    - ecat_dev_info"\
@@ -3057,6 +3057,20 @@ zeek_logs_enabled() {
                         "    - opcua_binary_browse_response_references"\
                         "    - opcua_binary_browse_diagnostic_info"\
                         "    - opcua_binary_create_subscription"\
-                        "    - opcua_binary_read" >> "$zeeklogs_pillar"
+                        "    - opcua_binary_read"
+			"    - cotp"\
+			"    - s7comm"\
+			"    - s7comm_read_szl"\
+			"    - s7comm_upload_download"\
+			"    - s7comm_plus"\
+			"    - tds"\
+			"    - tds_rpc"\
+			"    - tds_sql_batch"\
+			"    - profinet_dce_rpc"\
+			"    - profinet"\
+			"    - profinet_debug"\
+			"    - stun"\
+			"    - stun_nat"\
+			"    - wireguard" >> "$zeeklogs_pillar"
 	fi
 }

setup/so-whiptail

@@ -1363,7 +1363,21 @@ whiptail_manager_adv_service_zeeklogs() {
         "opcua_binary_browse_response_references" "OPC UA Browse" ON \
         "opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
         "opcua_binary_create_subscription" "OPC UA UA Browse" ON \
-        "opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3)
+        "opcua_binary_read" "OPC UA Read" ON \
+ 	"cotp" "COTP" ON \
+	"s7comm" "S7COMM Header" ON \
+	"s7comm_read_szl" "S7COMM Read-SZL" ON \
+	"s7comm_upload_download" "S7COMM Upoad Download" ON \
+	"s7comm_plus" "S7COMM Plus" ON \
+	"tds" "Tabular Data Streams" ON \
+	"tds_rpc" "TDS RPC" ON \
+	"tds_sql_batch" "TDS SQL" ON \
+	"profinet" "Profinet" ON \
+	"profinet_dce_rpc" "Profinet DCE RPC" ON \
+	"profinet_debug" "Profinet Debug" ON \
+	"stun" "STUN" ON \
+	"stun_nat" "STUN NAT" ON \
+	"wireguard" "Wireguard" ON 3>&1 1>&2 2>&3)
 
 	local exitstatus=$?
 	whiptail_check_exitstatus $exitstatus