mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 21:52:47 +01:00
87 lines
3.3 KiB
YAML
87 lines
3.3 KiB
YAML
zeek:
|
|
config:
|
|
node:
|
|
lb_procs: 1
|
|
zeek_pins_enabled: False
|
|
zeek_pins: []
|
|
zeekctl:
|
|
MailTo: root@localhost
|
|
MailConnectionSummary: 1
|
|
MinDiskSpace: 5
|
|
MailHostUpDown: 1
|
|
LogRotationInterval: 3600
|
|
LogExpireInterval: 0
|
|
StatsLogEnable: 1
|
|
StatsLogExpireInterval: 0
|
|
StatusCmdShowAll: 0
|
|
CrashExpireInterval: 0
|
|
SitePolicyScripts: local.zeek
|
|
LogDir: /nsm/zeek/logs
|
|
SpoolDir: /nsm/zeek/spool
|
|
CfgDir: /opt/zeek/etc
|
|
CompressLogs: 1
|
|
policy:
|
|
file_extraction:
|
|
- application/x-dosexec: exe
|
|
- application/pdf: pdf
|
|
- application/msword: doc
|
|
- application/vnd.ms-powerpoint: doc
|
|
- application/rtf: doc
|
|
- application/vnd.ms-word.document.macroenabled.12: doc
|
|
- application/vnd.ms-word.template.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.template.macroenabled.12: doc
|
|
- application/vnd.ms-excel: doc
|
|
- application/vnd.ms-excel.addin.macroenabled.12: doc
|
|
- application/vnd.ms-excel.sheet.binary.macroenabled.12: doc
|
|
- application/vnd.ms-excel.template.macroenabled.12: doc
|
|
- application/vnd.ms-excel.sheet.macroenabled.12: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.presentation: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.slide: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.slideshow: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.template: doc
|
|
- application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: doc
|
|
- application/vnd.openxmlformats-officedocument.spreadsheetml.template: doc
|
|
- application/vnd.openxmlformats-officedocument.wordprocessingml.document: doc
|
|
- application/vnd.openxmlformats-officedocument.wordprocessingml.template: doc
|
|
- application/vnd.ms-powerpoint.addin.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.slide.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.presentation.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.slideshow.macroenabled.12: doc
|
|
- application/vnd.openxmlformats-officedocument: doc
|
|
load:
|
|
- misc/loaded-scripts
|
|
- tuning/defaults
|
|
- misc/capture-loss
|
|
- misc/stats
|
|
- frameworks/software/vulnerable
|
|
- frameworks/software/version-changes
|
|
- protocols/ftp/software
|
|
- protocols/smtp/software
|
|
- protocols/ssh/software
|
|
- protocols/http/software
|
|
- protocols/dns/detect-external-names
|
|
- protocols/ftp/detect
|
|
- protocols/conn/known-hosts
|
|
- protocols/conn/known-services
|
|
- protocols/ssl/known-certs
|
|
- protocols/ssl/validate-certs
|
|
- protocols/ssl/log-hostcerts-only
|
|
- protocols/ssh/geo-data
|
|
- protocols/ssh/detect-bruteforcing
|
|
- protocols/ssh/interesting-hostnames
|
|
- protocols/http/detect-sqli
|
|
- frameworks/files/hash-all-files
|
|
- frameworks/files/detect-MHR
|
|
- policy/frameworks/notice/extend-email/hostnames
|
|
- ja3
|
|
- hassh
|
|
- intel
|
|
- cve-2020-0601
|
|
- securityonion/bpfconf
|
|
- securityonion/communityid
|
|
- securityonion/file-extraction
|
|
load-sigs:
|
|
- frameworks/signatures/detect-windows-shells
|
|
redef:
|
|
- LogAscii::use_json = T;
|
|
- CaptureLoss::watch_interval = 5 mins; |