CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add s7comm,tds,stun,profinet,wireguard

Browse Source
This commit is contained in:
lock-wire
2022-11-16 21:41:02 -06:00
parent d890f75cca
commit 1b8e546045
4 changed files with 51 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pillar/zeek/init.sls
View File

@@ -56,6 +56,11 @@ zeek:
- icsnpp-ethercat
- icsnpp-enip
- icsnpp-opcua-binary
- icsnpp-s7comm
- zeek-plugin-tds
- zeek-plugin-profinet
- zeek-spicy-wireguard
- zeek-spicy-stun
'@load-sigs':
- frameworks/signatures/detect-windows-shells
redef:

16
salt/common/tools/sbin/so-zeek-logs
View File

@@ -93,7 +93,21 @@ whiptail_manager_adv_service_zeeklogs() {
"opcua_binary_browse_response_references" "OPC UA Browse" ON \
"opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
"opcua_binary_create_subscription" "OPC UA UA Browse" ON \
"opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3 )
"opcua_binary_read" "OPC UA Read" ON \
"cotp" "COTP" ON \
"s7comm" "S7COMM Header" ON \
"s7comm_read_szl" "S7COMM Read-SZL" ON \
"s7comm_upload_download" "S7COMM Upoad Download" ON \
"s7comm_plus" "S7COMM Plus" ON \
"tds" "Tabular Data Streams" ON \
"tds_rpc" "TDS RPC" ON \
"tds_sql_batch" "TDS SQL" ON \
"profinet" "Profinet" ON \
"profinet_dce_rpc" "Profinet DCE RPC" ON \
"profinet_debug" "Profinet Debug" ON \
"stun" "STUN" ON \
"stun_nat" "STUN NAT" ON \
"wireguard" "Wireguard" ON 3>&1 1>&2 2>&3 )
local exitstatus=$?

18
setup/so-functions
View File

@@ -3020,7 +3020,7 @@ zeek_logs_enabled() {
" - modbus_read_write_multiple_registers"\
" - bacnet"\
" - bacnet_discovery"\
" - bacnet_property"
" - bacnet_property"\
" - ecat_registers"\
" - ecat_log_address"\
" - ecat_dev_info"\
@@ -3057,6 +3057,20 @@ zeek_logs_enabled() {
" - opcua_binary_browse_response_references"\
" - opcua_binary_browse_diagnostic_info"\
" - opcua_binary_create_subscription"\
" - opcua_binary_read" >> "$zeeklogs_pillar"
" - opcua_binary_read"
" - cotp"\
" - s7comm"\
" - s7comm_read_szl"\
" - s7comm_upload_download"\
" - s7comm_plus"\
" - tds"\
" - tds_rpc"\
" - tds_sql_batch"\
" - profinet_dce_rpc"\
" - profinet"\
" - profinet_debug"\
" - stun"\
" - stun_nat"\
" - wireguard" >> "$zeeklogs_pillar"
fi
}

16
setup/so-whiptail
View File

@@ -1363,7 +1363,21 @@ whiptail_manager_adv_service_zeeklogs() {
"opcua_binary_browse_response_references" "OPC UA Browse" ON \
"opcua_binary_browse_diagnostic_info" "OPC UA Browse" ON \
"opcua_binary_create_subscription" "OPC UA UA Browse" ON \
"opcua_binary_read" "OPC UA Read" ON 3>&1 1>&2 2>&3)
"opcua_binary_read" "OPC UA Read" ON \
"cotp" "COTP" ON \
"s7comm" "S7COMM Header" ON \
"s7comm_read_szl" "S7COMM Read-SZL" ON \
"s7comm_upload_download" "S7COMM Upoad Download" ON \
"s7comm_plus" "S7COMM Plus" ON \
"tds" "Tabular Data Streams" ON \
"tds_rpc" "TDS RPC" ON \
"tds_sql_batch" "TDS SQL" ON \
"profinet" "Profinet" ON \
"profinet_dce_rpc" "Profinet DCE RPC" ON \
"profinet_debug" "Profinet Debug" ON \
"stun" "STUN" ON \
"stun_nat" "STUN NAT" ON \
"wireguard" "Wireguard" ON 3>&1 1>&2 2>&3)
local exitstatus=$?
whiptail_check_exitstatus $exitstatus