Move In Day

2026-06-14 14:18:40 +02:00 · 2022-09-07 09:06:25 -04:00
parent dcb7b49dbe
commit 2bd9dd80e2
611 changed files with 8015 additions and 16211 deletions
@@ -0,0 +1,120 @@
+zeek:
+  logging:
+    enabled:
+      - conn
+      - dce_rpc
+      - dhcp
+      - dnp3
+      - dns
+      - dpd
+      - files
+      - ftp
+      - http
+      - intel
+      - irc
+      - kerberos
+      - modbus
+      - notice
+      - ntlm
+      - pe
+      - radius
+      - rfb
+      - rdp
+      - sip
+      - smb_files
+      - smb_mapping
+      - smtp
+      - snmp
+      - ssh
+      - ssl
+      - tunnel
+      - weird
+      - mysql
+      - socks
+      - x509
+  config:
+    node:
+      lb_procs: 1
+      zeek_pins_enabled: False
+      zeek_pins: []
+    zeekctl:
+      MailTo: root@localhost
+      MailConnectionSummary: 1
+      MinDiskSpace: 5
+      MailHostUpDown: 1
+      LogRotationInterval: 3600
+      LogExpireInterval: 0
+      StatsLogEnable: 1
+      StatsLogExpireInterval: 0
+      StatusCmdShowAll: 0
+      CrashExpireInterval: 0
+      SitePolicyScripts: local.zeek
+      LogDir: /nsm/zeek/logs
+      SpoolDir: /nsm/zeek/spool
+      CfgDir: /opt/zeek/etc
+      CompressLogs: 1
+  policy:
+    file_extraction:
+      - application/x-dosexec: exe
+      - application/pdf: pdf
+      - application/msword: doc
+      - application/vnd.ms-powerpoint: doc
+      - application/rtf: doc
+      - application/vnd.ms-word.document.macroenabled.12: doc
+      - application/vnd.ms-word.template.macroenabled.12: doc
+      - application/vnd.ms-powerpoint.template.macroenabled.12: doc
+      - application/vnd.ms-excel: doc
+      - application/vnd.ms-excel.addin.macroenabled.12: doc
+      - application/vnd.ms-excel.sheet.binary.macroenabled.12: doc
+      - application/vnd.ms-excel.template.macroenabled.12: doc
+      - application/vnd.ms-excel.sheet.macroenabled.12: doc
+      - application/vnd.openxmlformats-officedocument.presentationml.presentation: doc
+      - application/vnd.openxmlformats-officedocument.presentationml.slide: doc
+      - application/vnd.openxmlformats-officedocument.presentationml.slideshow: doc
+      - application/vnd.openxmlformats-officedocument.presentationml.template: doc
+      - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: doc
+      - application/vnd.openxmlformats-officedocument.spreadsheetml.template: doc
+      - application/vnd.openxmlformats-officedocument.wordprocessingml.document: doc
+      - application/vnd.openxmlformats-officedocument.wordprocessingml.template: doc
+      - application/vnd.ms-powerpoint.addin.macroenabled.12: doc
+      - application/vnd.ms-powerpoint.slide.macroenabled.12: doc
+      - application/vnd.ms-powerpoint.presentation.macroenabled.12: doc
+      - application/vnd.ms-powerpoint.slideshow.macroenabled.12: doc
+      - application/vnd.openxmlformats-officedocument: doc
+    load:
+      - misc/loaded-scripts
+      - tuning/defaults
+      - misc/capture-loss
+      - misc/stats
+      - frameworks/software/vulnerable
+      - frameworks/software/version-changes
+      - protocols/ftp/software
+      - protocols/smtp/software
+      - protocols/ssh/software
+      - protocols/http/software
+      - protocols/dns/detect-external-names
+      - protocols/ftp/detect
+      - protocols/conn/known-hosts
+      - protocols/conn/known-services
+      - protocols/ssl/known-certs
+      - protocols/ssl/validate-certs
+      - protocols/ssl/log-hostcerts-only
+      - protocols/ssh/geo-data
+      - protocols/ssh/detect-bruteforcing
+      - protocols/ssh/interesting-hostnames
+      - protocols/http/detect-sqli
+      - frameworks/files/hash-all-files
+      - frameworks/files/detect-MHR
+      - policy/frameworks/notice/extend-email/hostnames
+      - ja3
+      - hassh
+      - intel
+      - cve-2020-0601
+      - securityonion/bpfconf
+      - securityonion/communityid
+      - securityonion/file-extraction
+    load-sigs:
+      - frameworks/signatures/detect-windows-shells
+    redef:
+      - LogAscii::use_json = T;
+      - CaptureLoss::watch_interval = 5 mins;