mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-04-19 19:21:53 +02:00
117 lines
6.2 KiB
YAML
117 lines
6.2 KiB
YAML
zeek:
|
|
enabled:
|
|
description: Controls whether the Zeek (network packet inspection) process runs. Disabling this process could result in loss of network protocol metadata. If Suricata was selected as the protocol metadata engine during setup then this will already be disabled.
|
|
forcedType: bool
|
|
helpLink: zeek
|
|
ja4plus:
|
|
enabled:
|
|
description: "Enables JA4+ fingerprinting (JA4S, JA4D, JA4H, JA4L, JA4SSH, JA4T, JA4TS, JA4X). By enabling this, you agree to the terms of the JA4+ license [https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE](https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE)."
|
|
forcedType: bool
|
|
helpLink: zeek
|
|
advanced: False
|
|
config:
|
|
local:
|
|
load:
|
|
description: Contains a list of policies and scripts loaded by Zeek. Values in the Current Grid Value dialog box apply to every instance of Zeek. Values in a dialog box for a specific node will only apply to that node.
|
|
forcedType: "[]string"
|
|
helpLink: zeek
|
|
load-sigs:
|
|
description: Contains a list of signatures loaded by Zeek. Values placed in the Current Grid Value dialog box apply to every instance of Zeek. Values placed in a dialog box for a specific node will only apply to that node.
|
|
forcedType: "[]string"
|
|
helpLink: zeek
|
|
redef:
|
|
description: List of Zeek variables to redefine. Values placed in the Current Grid Value dialog box apply to every instance of Zeek. Values placed in a dialog box for a specific node will only apply to that node.
|
|
forcedType: "[]string"
|
|
advanced: True
|
|
helpLink: zeek
|
|
networks:
|
|
HOME_NET:
|
|
description: List of IP or CIDR blocks to define as the HOME_NET.
|
|
forcedType: "[]string"
|
|
advanced: False
|
|
helpLink: zeek
|
|
multiline: True
|
|
regex: ^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\/([0-9]|[1-2][0-9]|3[0-2]))?$|^((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?))|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(:((:[0-9A-Fa-f]{1,4}){1,7}|:)))(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$
|
|
regexFailureMessage: You must enter a valid IP address or CIDR.
|
|
node:
|
|
lb_procs:
|
|
description: Contains the number of CPU cores or workers used by Zeek. This setting should only be applied to individual nodes and will be ignored if CPU affinity is enabled.
|
|
title: workers
|
|
helpLink: zeek
|
|
node: True
|
|
pins_enabled:
|
|
description: Enabling this setting allows you to pin Zeek to specific CPUs.
|
|
title: cpu affinity enabled
|
|
forcedType: bool
|
|
helpLink: zeek
|
|
node: True
|
|
advanced: True
|
|
pins:
|
|
description: Contains a list of specific CPU cores pinned to Zeek workers. To set the CPU affinity, enter the processor ID number in the dialog box for the desired node. To retrieve the processor ID numbers, run the command "cat /proc/cpuinfo | grep processor" on the desired node. Please note that this setting should only be applied to individual nodes.
|
|
title: cpu affinity
|
|
multiline: True
|
|
forcedType: "[]string"
|
|
helpLink: zeek
|
|
node: True
|
|
advanced: True
|
|
zeekctl:
|
|
CompressLogs:
|
|
description: This setting enables compression of Zeek logs. If you are seeing packet loss at the top of the hour in Zeek or PCAP you might need to disable this by seting it to 0. This will use more disk space but save IO and CPU.
|
|
helpLink: zeek
|
|
policy:
|
|
custom:
|
|
filters:
|
|
conn:
|
|
description: Conn Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
dns:
|
|
description: DNS Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
files:
|
|
description: Files Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
httphost:
|
|
description: HTTP Hosts Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
httpuri:
|
|
description: HTTP URI Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
ssl:
|
|
description: SSL Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
tunnel:
|
|
description: Tunnel Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
file_extraction:
|
|
description: Contains a list of file or MIME types Zeek will extract from the network streams. Values must adhere to the following format - {"MIME_TYPE":"FILE_EXTENSION"}
|
|
forcedType: "[]{}"
|
|
helpLink: zeek
|