From adb925b4d613eda648856cf57d6d08a10c19ce94 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 3 Mar 2023 12:48:42 -0500 Subject: [PATCH 1/6] enable zeek vlan script --- salt/zeek/defaults.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/zeek/defaults.yaml b/salt/zeek/defaults.yaml index ec3eef3a2..64a332746 100644 --- a/salt/zeek/defaults.yaml +++ b/salt/zeek/defaults.yaml @@ -44,6 +44,7 @@ zeek: - protocols/ssh/detect-bruteforcing - protocols/ssh/interesting-hostnames - protocols/http/detect-sqli + - protocols/conn/vlan-logging - frameworks/files/hash-all-files - frameworks/files/detect-MHR - policy/frameworks/notice/extend-email/hostnames From 9940a36722242a0e5787d4a04681e4d585d095a5 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 3 Mar 2023 15:22:43 -0500 Subject: [PATCH 2/6] update Elasticsearch ingest for Zeek conn vlan field --- salt/elasticsearch/files/ingest/zeek.conn | 29 ++++++++++++----------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/salt/elasticsearch/files/ingest/zeek.conn b/salt/elasticsearch/files/ingest/zeek.conn index 73ce29c1d..8b458e032 100644 --- a/salt/elasticsearch/files/ingest/zeek.conn +++ b/salt/elasticsearch/files/ingest/zeek.conn @@ -2,27 +2,28 @@ "description" : "zeek.conn", "processors" : [ { "set": { "field": "event.dataset", "value": "conn" } }, - { "remove": { "field": ["host"], "ignore_failure": true } }, - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "remove": { "field": ["host"], "ignore_failure": true } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_missing": true } }, { "rename": { "field": "message2.service", "target_field": "network.protocol", "ignore_missing": true } }, { "rename": { "field": "message2.duration", "target_field": "event.duration", "ignore_missing": true } }, - { "rename": { "field": "message2.orig_bytes", "target_field": "client.bytes", "ignore_missing": true } }, - { "rename": { "field": "message2.resp_bytes", "target_field": "server.bytes", "ignore_missing": true } }, - { "rename": { "field": "message2.conn_state", "target_field": "connection.state", "ignore_missing": true } }, - { "rename": { "field": "message2.local_orig", "target_field": "connection.local.originator", "ignore_missing": true } }, + { "rename": { "field": "message2.orig_bytes", "target_field": "client.bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.resp_bytes", "target_field": "server.bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.conn_state", "target_field": "connection.state", "ignore_missing": true } }, + { "rename": { "field": "message2.local_orig", "target_field": "connection.local.originator", "ignore_missing": true } }, { "rename": { "field": "message2.local_resp", "target_field": "connection.local.responder", "ignore_missing": true } }, - { "rename": { "field": "message2.missed_bytes", "target_field": "connection.bytes.missed", "ignore_missing": true } }, + { "rename": { "field": "message2.missed_bytes", "target_field": "connection.bytes.missed", "ignore_missing": true } }, { "rename": { "field": "message2.history", "target_field": "connection.history", "ignore_missing": true } }, - { "rename": { "field": "message2.orig_pkts", "target_field": "client.packets", "ignore_missing": true } }, - { "rename": { "field": "message2.orig_ip_bytes", "target_field": "client.ip_bytes", "ignore_missing": true } }, - { "rename": { "field": "message2.resp_pkts", "target_field": "server.packets", "ignore_missing": true } }, - { "rename": { "field": "message2.resp_ip_bytes", "target_field": "server.ip_bytes", "ignore_missing": true } }, - { "rename": { "field": "message2.orig_mac_oui", "target_field": "client.oui", "ignore_missing": true } }, + { "rename": { "field": "message2.orig_pkts", "target_field": "client.packets", "ignore_missing": true } }, + { "rename": { "field": "message2.orig_ip_bytes", "target_field": "client.ip_bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.resp_pkts", "target_field": "server.packets", "ignore_missing": true } }, + { "rename": { "field": "message2.resp_ip_bytes", "target_field": "server.ip_bytes", "ignore_missing": true } }, + { "rename": { "field": "message2.orig_mac_oui", "target_field": "client.oui", "ignore_missing": true } }, { "rename": { "field": "message2.tunnel_parents", "target_field": "log.id.tunnel_parents", "ignore_missing": true } }, - { "rename": { "field": "message2.orig_cc", "target_field": "client.country_code","ignore_missing": true } }, - { "rename": { "field": "message2.resp_cc", "target_field": "server.country_code", "ignore_missing": true } }, + { "rename": { "field": "message2.orig_cc", "target_field": "client.country_code", "ignore_missing": true } }, + { "rename": { "field": "message2.resp_cc", "target_field": "server.country_code", "ignore_missing": true } }, { "rename": { "field": "message2.sensorname", "target_field": "observer.name", "ignore_missing": true } }, + { "rename": { "field": "message2.vlan", "target_field": "network.vlan.id", "ignore_missing": true } }, { "script": { "lang": "painless", "source": "ctx.network.bytes = (ctx.client.bytes + ctx.server.bytes)", "ignore_failure": true } }, { "set": { "if": "ctx.connection?.state == 'S0'", "field": "connection.state_description", "value": "Connection attempt seen, no reply" } }, { "set": { "if": "ctx.connection?.state == 'S1'", "field": "connection.state_description", "value": "Connection established, not terminated" } }, From e24296d5365ceaf2b0d25fc28ec020a59be989e5 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 3 Mar 2023 15:23:43 -0500 Subject: [PATCH 3/6] add SOC Dashboards groupby for Zeek conn vlan field --- salt/soc/defaults.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index 9a468902c..a2b6e43e6 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1419,7 +1419,7 @@ soc: query: 'event.dataset:notice | groupby -sankey notice.note destination.ip | groupby notice.note | groupby notice.message | groupby notice.sub_message | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name' - name: Connections description: Network connection metadata - query: 'event.dataset:conn | groupby source.ip | groupby destination.ip | groupby destination.port | groupby -sankey destination.port network.protocol | groupby network.protocol | groupby network.transport | groupby connection.history | groupby connection.state | groupby connection.state_description | groupby source.geo.country_name | groupby destination.geo.country_name | groupby client.ip_bytes | groupby server.ip_bytes | groupby client.oui' + query: 'event.dataset:conn | groupby source.ip | groupby destination.ip | groupby destination.port | groupby -sankey destination.port network.protocol | groupby network.protocol | groupby network.transport | groupby connection.history | groupby connection.state | groupby connection.state_description | groupby source.geo.country_name | groupby destination.geo.country_name | groupby client.ip_bytes | groupby server.ip_bytes | groupby client.oui | groupby network.vlan.id' - name: DCE_RPC description: DCE_RPC (Distributed Computing Environment / Remote Procedure Calls) network metadata query: 'event.dataset:dce_rpc | groupby -sankey dce_rpc.endpoint dce_rpc.operation | groupby dce_rpc.endpoint | groupby dce_rpc.operation | groupby dce_rpc.named_pipe | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name' From 4a2e75dd8c597bbab364b730c04452deae10caa7 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Fri, 3 Mar 2023 17:16:45 -0500 Subject: [PATCH 4/6] fix formatting --- salt/zeek/defaults.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/zeek/defaults.yaml b/salt/zeek/defaults.yaml index 64a332746..18e8a4d8a 100644 --- a/salt/zeek/defaults.yaml +++ b/salt/zeek/defaults.yaml @@ -37,6 +37,7 @@ zeek: - protocols/ftp/detect - protocols/conn/known-hosts - protocols/conn/known-services + - protocols/conn/vlan-logging - protocols/ssl/known-certs - protocols/ssl/validate-certs - protocols/ssl/log-hostcerts-only @@ -44,7 +45,6 @@ zeek: - protocols/ssh/detect-bruteforcing - protocols/ssh/interesting-hostnames - protocols/http/detect-sqli - - protocols/conn/vlan-logging - frameworks/files/hash-all-files - frameworks/files/detect-MHR - policy/frameworks/notice/extend-email/hostnames From 19ab2a5a4667b1d162acca5f45626603eab75ccd Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Sun, 5 Mar 2023 05:57:52 -0500 Subject: [PATCH 5/6] rename suricata vlan field to network.vlan.id --- .../files/ingest/suricata.common | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/salt/elasticsearch/files/ingest/suricata.common b/salt/elasticsearch/files/ingest/suricata.common index 6e956d196..4dea07b8b 100644 --- a/salt/elasticsearch/files/ingest/suricata.common +++ b/salt/elasticsearch/files/ingest/suricata.common @@ -1,19 +1,20 @@ { "description" : "suricata.common", "processors" : [ - { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, - { "rename":{ "field": "message2.proto", "target_field": "network.transport", "ignore_failure": true } }, - { "rename":{ "field": "message2.flow_id", "target_field": "log.id.uid", "ignore_failure": true } }, - { "rename":{ "field": "message2.src_ip", "target_field": "source.ip", "ignore_failure": true } }, - { "rename":{ "field": "message2.src_port", "target_field": "source.port", "ignore_failure": true } }, - { "rename":{ "field": "message2.dest_ip", "target_field": "destination.ip", "ignore_failure": true } }, - { "rename":{ "field": "message2.dest_port", "target_field": "destination.port", "ignore_failure": true } }, - { "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_missing": true } }, - { "set": { "field": "event.dataset", "value": "{{ message2.event_type }}" } }, - { "set": { "field": "observer.name", "value": "{{agent.name}}" } }, - { "set": { "field": "event.ingested", "value": "{{@timestamp}}" } }, + { "json": { "field": "message", "target_field": "message2", "ignore_failure": true } }, + { "rename": { "field": "message2.proto", "target_field": "network.transport", "ignore_failure": true } }, + { "rename": { "field": "message2.flow_id", "target_field": "log.id.uid", "ignore_failure": true } }, + { "rename": { "field": "message2.src_ip", "target_field": "source.ip", "ignore_failure": true } }, + { "rename": { "field": "message2.src_port", "target_field": "source.port", "ignore_failure": true } }, + { "rename": { "field": "message2.dest_ip", "target_field": "destination.ip", "ignore_failure": true } }, + { "rename": { "field": "message2.dest_port", "target_field": "destination.port", "ignore_failure": true } }, + { "rename": { "field": "message2.vlan", "target_field": "network.vlan.id", "ignore_failure": true } }, + { "rename": { "field": "message2.community_id", "target_field": "network.community_id", "ignore_missing": true } }, + { "set": { "field": "event.dataset", "value": "{{ message2.event_type }}" } }, + { "set": { "field": "observer.name", "value": "{{agent.name}}" } }, + { "set": { "field": "event.ingested", "value": "{{@timestamp}}" } }, { "date": { "field": "message2.timestamp", "target_field": "@timestamp", "formats": ["ISO8601", "UNIX"], "timezone": "UTC", "ignore_failure": true } }, - { "remove":{ "field": "agent", "ignore_failure": true } }, + { "remove":{ "field": "agent", "ignore_failure": true } }, { "pipeline": { "if": "ctx?.event?.dataset != null", "name": "suricata.{{event.dataset}}" } } ] } From a2bda07820099440cd79c74d8e2158e75706e136 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Sun, 5 Mar 2023 15:24:11 -0500 Subject: [PATCH 6/6] add VLAN dashboard --- salt/soc/defaults.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml index a2b6e43e6..3fe2f4567 100644 --- a/salt/soc/defaults.yaml +++ b/salt/soc/defaults.yaml @@ -1419,7 +1419,7 @@ soc: query: 'event.dataset:notice | groupby -sankey notice.note destination.ip | groupby notice.note | groupby notice.message | groupby notice.sub_message | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name' - name: Connections description: Network connection metadata - query: 'event.dataset:conn | groupby source.ip | groupby destination.ip | groupby destination.port | groupby -sankey destination.port network.protocol | groupby network.protocol | groupby network.transport | groupby connection.history | groupby connection.state | groupby connection.state_description | groupby source.geo.country_name | groupby destination.geo.country_name | groupby client.ip_bytes | groupby server.ip_bytes | groupby client.oui | groupby network.vlan.id' + query: 'event.dataset:conn | groupby source.ip | groupby destination.ip | groupby destination.port | groupby -sankey destination.port network.protocol | groupby network.protocol | groupby network.transport | groupby connection.history | groupby connection.state | groupby connection.state_description | groupby source.geo.country_name | groupby destination.geo.country_name | groupby client.ip_bytes | groupby server.ip_bytes | groupby client.oui' - name: DCE_RPC description: DCE_RPC (Distributed Computing Environment / Remote Procedure Calls) network metadata query: 'event.dataset:dce_rpc | groupby -sankey dce_rpc.endpoint dce_rpc.operation | groupby dce_rpc.endpoint | groupby dce_rpc.operation | groupby dce_rpc.named_pipe | groupby source.ip | groupby destination.ip | groupby destination.port | groupby destination_geo.organization_name' @@ -1555,6 +1555,9 @@ soc: - name: Firewall description: Firewall logs query: 'event.dataset:firewall | groupby -sankey rule.action interface.name | groupby rule.action | groupby interface.name | groupby network.transport | groupby source.ip | groupby destination.ip | groupby destination.port' + - name: VLAN + description: VLAN (Virtual Local Area Network) tagged logs + query: '* AND _exists_:network.vlan.id | groupby network.vlan.id | groupby source.ip | groupby -sankey source.ip destination.ip | groupby destination.ip | groupby destination.port | groupby event.dataset | groupby event.module | groupby observer.name | groupby source.geo.country_name | groupby destination.geo.country_name' job: alerts: advanced: false