mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-11-09 22:20:00 +01:00
Josh Patterson
9652a2053b
zeekctl's post-terminate archives the final logs in the background and returns immediately unless StopWait is set, so the container exits and takes the archiving with it, stranding unarchived logs in /nsm/zeek/spool/tmp on every restart. Docker's default 10s grace is also too tight for the entrypoint's SIGTERM trap; overrunning it means SIGKILL and crash directories on the next start. Both are needed. StopWait alone gives the stop more work to do inside the same 10s window, which was measured ending in SIGKILL with logs stranded in the spool. disabled.sls used docker rm -f, which never delivers SIGTERM, so stop the container before removing it. Reported in discussion #16174.
209 lines
11 KiB
YAML
209 lines
11 KiB
YAML
zeek:
|
|
enabled:
|
|
description: Controls whether the Zeek (network packet inspection) process runs. Disabling this process could result in loss of network protocol metadata. If Suricata was selected as the protocol metadata engine during setup then this will already be disabled.
|
|
forcedType: bool
|
|
helpLink: zeek
|
|
ja4plus:
|
|
enabled:
|
|
description: "Enables JA4+ fingerprinting (JA4S, JA4D, JA4H, JA4L, JA4SSH, JA4T, JA4TS, JA4X). By enabling this, you agree to the terms of the JA4+ license [https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE](https://github.com/FoxIO-LLC/ja4/blob/main/LICENSE)."
|
|
forcedType: bool
|
|
helpLink: zeek
|
|
advanced: False
|
|
config:
|
|
local:
|
|
load:
|
|
description: Contains a list of policies and scripts loaded by Zeek. Values in the Current Grid Value dialog box apply to every instance of Zeek. Values in a dialog box for a specific node will only apply to that node.
|
|
forcedType: "[]string"
|
|
helpLink: zeek
|
|
load-sigs:
|
|
description: Contains a list of signatures loaded by Zeek. Values placed in the Current Grid Value dialog box apply to every instance of Zeek. Values placed in a dialog box for a specific node will only apply to that node.
|
|
forcedType: "[]string"
|
|
helpLink: zeek
|
|
redef:
|
|
description: List of Zeek variables to redefine. Values placed in the Current Grid Value dialog box apply to every instance of Zeek. Values placed in a dialog box for a specific node will only apply to that node.
|
|
forcedType: "[]string"
|
|
advanced: True
|
|
helpLink: zeek
|
|
networks:
|
|
HOME_NET:
|
|
description: List of IP or CIDR blocks to define as the HOME_NET.
|
|
forcedType: "[]string"
|
|
advanced: False
|
|
helpLink: zeek
|
|
multiline: True
|
|
regex: ^(((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\/([0-9]|[1-2][0-9]|3[0-2]))?$|^((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?))|:))|(([0-9A-Fa-f]{1,4}:){5}((:[0-9A-Fa-f]{1,4}){1,2}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){4}((:[0-9A-Fa-f]{1,4}){1,3}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){3}((:[0-9A-Fa-f]{1,4}){1,4}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){2}((:[0-9A-Fa-f]{1,4}){1,5}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(([0-9A-Fa-f]{1,4}:){1}((:[0-9A-Fa-f]{1,4}){1,6}|:((25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)\.){3}(25[0-5]|(2[0-4]|1[0-9])[0-9]|0?[0-9][0-9]?)|:))|(:((:[0-9A-Fa-f]{1,4}){1,7}|:)))(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$
|
|
regexFailureMessage: You must enter a valid IP address or CIDR.
|
|
node:
|
|
lb_procs:
|
|
description: Contains the number of CPU cores or workers used by Zeek. This setting should only be applied to individual nodes and will be ignored if CPU affinity is enabled.
|
|
title: workers
|
|
helpLink: zeek
|
|
node: True
|
|
pins_enabled:
|
|
description: Enabling this setting allows you to pin Zeek to specific CPUs.
|
|
title: cpu affinity enabled
|
|
forcedType: bool
|
|
helpLink: zeek
|
|
node: True
|
|
advanced: True
|
|
pins:
|
|
description: Contains a list of specific CPU cores pinned to Zeek workers. To set the CPU affinity, enter the processor ID number in the dialog box for the desired node. To retrieve the processor ID numbers, run the command "cat /proc/cpuinfo | grep processor" on the desired node. Please note that this setting should only be applied to individual nodes.
|
|
title: cpu affinity
|
|
multiline: True
|
|
forcedType: "[]string"
|
|
helpLink: zeek
|
|
node: True
|
|
advanced: True
|
|
zeekctl:
|
|
CompressLogs:
|
|
description: This setting enables compression of Zeek logs. If you are seeing packet loss at the top of the hour in Zeek or PCAP you might need to disable this by seting it to 0. This will use more disk space but save IO and CPU.
|
|
helpLink: zeek
|
|
LogExpireInterval:
|
|
description: >-
|
|
How long to keep rotated Zeek logs in /nsm/zeek/logs. A bare number means DAYS, so 7 means 7 days.
|
|
You may also give an explicit unit, such as "7 days" or "12 hr". Use 0 to keep logs forever.
|
|
This value must not be shorter than LogRotationInterval (3600 seconds by default), so the smallest
|
|
usable value is 1 hr - Zeek will fail to start if it is shorter. Expiry is applied by "zeekctl cron",
|
|
which runs every 5 minutes, and removes log files older than this based on their modification time.
|
|
regex: ^(0|[1-9][0-9]*( ?(day|hr)s?)?)$
|
|
regexFailureMessage: Enter 0, or a positive number optionally followed by "day" or "hr" (for example 7, "7 days", or "12 hr"). Minutes are not accepted because a log expire interval shorter than the log rotation interval prevents Zeek from starting.
|
|
helpLink: zeek
|
|
advanced: True
|
|
StatsLogEnable:
|
|
description: >-
|
|
Set to 1 to have "zeekctl cron" write node statistics to /nsm/zeek/logs/stats. This is
|
|
disabled because the CPU and memory portion depends on the "top" command, which the Zeek
|
|
container does not include, so every run records an error for each node instead. The
|
|
interface packet counters it also collects are not used anywhere in Security Onion, which
|
|
tracks Zeek packet loss separately through packetloss.log and Telegraf. It is read only
|
|
for that reason.
|
|
regex: ^[01]$
|
|
regexFailureMessage: You must enter 0 or 1.
|
|
helpLink: zeek
|
|
advanced: True
|
|
readonly: True
|
|
StatsLogExpireInterval:
|
|
description: >-
|
|
Number of days to keep entries in the Zeek stats log, or 0 to keep them forever.
|
|
Applied by "zeekctl cron", which runs every 5 minutes. This has no effect unless
|
|
StatsLogEnable is turned on, which it is not by default.
|
|
regex: ^[0-9]+$
|
|
regexFailureMessage: You must enter a whole number of days, or 0 to keep entries forever.
|
|
helpLink: zeek
|
|
advanced: True
|
|
CrashExpireInterval:
|
|
description: >-
|
|
Number of days to keep Zeek crash directories, or 0 to keep them forever.
|
|
Applied by "zeekctl cron", which runs every 5 minutes.
|
|
regex: ^[0-9]+$
|
|
regexFailureMessage: You must enter a whole number of days, or 0 to keep crash directories forever.
|
|
helpLink: zeek
|
|
advanced: True
|
|
StopWait:
|
|
description: >-
|
|
Set to 1 to make "zeekctl stop" wait for the final logs to be archived instead of
|
|
letting that finish in the background. Security Onion stops Zeek by stopping its
|
|
container, so anything still running in the background is killed when the container
|
|
exits - without this, the last logs of each run are stranded unarchived in
|
|
/nsm/zeek/spool/tmp and never reach Elasticsearch. It is read only for that reason.
|
|
regex: ^[01]$
|
|
regexFailureMessage: You must enter 0 or 1.
|
|
helpLink: zeek
|
|
advanced: True
|
|
readonly: True
|
|
MinDiskSpace:
|
|
description: >-
|
|
Percentage of free disk space below which ZeekControl reports a warning, or 0 to disable the check
|
|
entirely. The Zeek container does not include a mail program, so the warning is not emailed - it
|
|
appears in the output of "zeekctl cron" instead. This setting never deletes anything - cleanup based
|
|
on disk usage is handled separately by so-sensor-clean.
|
|
regex: ^([0-9]|[1-9][0-9]|100)$
|
|
regexFailureMessage: You must enter a percentage between 0 and 100.
|
|
helpLink: zeek
|
|
advanced: True
|
|
MailTo:
|
|
description: >-
|
|
Address that ZeekControl would send mail to, covering cron output and crash reports, and the address
|
|
Zeek's notice framework would use. The Zeek container does not include a mail program, and Security
|
|
Onion never enables the notice email action, so no mail is sent and this address is unused. It is
|
|
read only for that reason.
|
|
helpLink: zeek
|
|
advanced: True
|
|
readonly: True
|
|
MailConnectionSummary:
|
|
description: >-
|
|
Set to 1 to email the hourly connection summary. This only controls the emailed copy - the summary is
|
|
generated and archived with the other Zeek logs either way. The Zeek container does not include a mail
|
|
program, so no mail is sent and this setting has no effect. It is read only for that reason.
|
|
regex: ^[01]$
|
|
regexFailureMessage: You must enter 0 or 1.
|
|
helpLink: zeek
|
|
advanced: True
|
|
readonly: True
|
|
MailHostUpDown:
|
|
description: >-
|
|
Set to 1 to report when a Zeek node changes between the up and down states. The Zeek container does
|
|
not include a mail program, so this notification cannot be emailed. It is read only for that reason.
|
|
Host status detection still runs regardless of this setting - only the notification is affected.
|
|
regex: ^[01]$
|
|
regexFailureMessage: You must enter 0 or 1.
|
|
helpLink: zeek
|
|
advanced: True
|
|
readonly: True
|
|
policy:
|
|
custom:
|
|
filters:
|
|
conn:
|
|
description: Conn Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
dns:
|
|
description: DNS Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
files:
|
|
description: Files Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
httphost:
|
|
description: HTTP Hosts Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
httpuri:
|
|
description: HTTP URI Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
ssl:
|
|
description: SSL Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
tunnel:
|
|
description: Tunnel Filter for Zeek. This is an advanced setting and will take further action to enable.
|
|
helpLink: zeek
|
|
file: True
|
|
global: True
|
|
advanced: True
|
|
duplicates: True
|
|
file_extraction:
|
|
description: Contains a list of file or MIME types Zeek will extract from the network streams. Values must adhere to the following format - {"MIME_TYPE":"FILE_EXTENSION"}
|
|
forcedType: "[]{}"
|
|
helpLink: zeek
|