mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-09-19 22:29:24 +02:00
Josh Patterson
9652a2053b
zeekctl's post-terminate archives the final logs in the background and returns immediately unless StopWait is set, so the container exits and takes the archiving with it, stranding unarchived logs in /nsm/zeek/spool/tmp on every restart. Docker's default 10s grace is also too tight for the entrypoint's SIGTERM trap; overrunning it means SIGKILL and crash directories on the next start. Both are needed. StopWait alone gives the stop more work to do inside the same 10s window, which was measured ending in SIGKILL with logs stranded in the spool. disabled.sls used docker rm -f, which never delivers SIGTERM, so stop the container before removing it. Reported in discussion #16174.
131 lines
4.3 KiB
YAML
131 lines
4.3 KiB
YAML
zeek:
|
|
enabled: False
|
|
ja4plus:
|
|
enabled: False
|
|
config:
|
|
node:
|
|
lb_procs: 0
|
|
pins_enabled: False
|
|
pins: []
|
|
buffer: 128*1024*1024
|
|
zeekctl:
|
|
MailTo: root@localhost
|
|
MailConnectionSummary: 0
|
|
MinDiskSpace: 5
|
|
MailHostUpDown: 0
|
|
LogRotationInterval: 3600
|
|
LogExpireInterval: 0
|
|
StatsLogEnable: 0
|
|
StatsLogExpireInterval: 0
|
|
StatusCmdShowAll: 0
|
|
StopWait: 1
|
|
CrashExpireInterval: 0
|
|
SitePolicyScripts: local.zeek
|
|
LogDir: /nsm/zeek/logs
|
|
SpoolDir: /nsm/zeek/spool
|
|
CfgDir: /opt/zeek/etc
|
|
CompressLogs: 1
|
|
ZeekPort: 27760
|
|
FileExtractDir: ""
|
|
local:
|
|
load:
|
|
- misc/loaded-scripts
|
|
- misc/capture-loss
|
|
- frameworks/software/vulnerable
|
|
- frameworks/software/version-changes
|
|
- protocols/ftp/software
|
|
- protocols/smtp/software
|
|
- protocols/ssh/software
|
|
- protocols/http/software
|
|
- protocols/dns/detect-external-names
|
|
- protocols/ftp/detect
|
|
- protocols/conn/known-hosts
|
|
- protocols/conn/known-services
|
|
- protocols/conn/vlan-logging
|
|
- protocols/ssl/known-certs
|
|
- protocols/ssl/validate-certs
|
|
- protocols/ssl/log-hostcerts-only
|
|
- protocols/ssh/geo-data
|
|
- protocols/ssh/detect-bruteforcing
|
|
- protocols/ssh/interesting-hostnames
|
|
- protocols/http/detect-sql-injection
|
|
- frameworks/files/hash-all-files
|
|
- frameworks/files/detect-MHR
|
|
- policy/frameworks/notice/extend-email/hostnames
|
|
- policy/frameworks/notice/community-id
|
|
- policy/protocols/conn/community-id-logging
|
|
- ja3
|
|
- ja4
|
|
- hassh
|
|
- intel
|
|
- cve-2020-0601
|
|
- securityonion/bpfconf
|
|
- securityonion/file-extraction
|
|
- securityonion/community-id-extended
|
|
- oui-logging
|
|
- icsnpp-dnp3
|
|
- icsnpp-bacnet
|
|
- icsnpp-ethercat
|
|
- icsnpp-enip
|
|
- icsnpp-opcua-binary
|
|
- icsnpp-bsap
|
|
- icsnpp-s7comm
|
|
- zeek-plugin-tds
|
|
- zeek-plugin-profinet
|
|
- zeek-spicy-wireguard
|
|
- zeek-spicy-stun
|
|
- http2
|
|
- zeek-spicy-ipsec
|
|
- zeek-spicy-openvpn
|
|
load-sigs:
|
|
- frameworks/signatures/detect-windows-shells
|
|
redef:
|
|
- LogAscii::use_json = T;
|
|
- CaptureLoss::watch_interval = 5 mins;
|
|
networks:
|
|
HOME_NET:
|
|
- 192.168.0.0/16
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
file_extraction:
|
|
- application/x-dosexec: exe
|
|
- application/pdf: pdf
|
|
- application/msword: doc
|
|
- application/vnd.ms-powerpoint: doc
|
|
- application/rtf: doc
|
|
- application/vnd.ms-word.document.macroenabled.12: doc
|
|
- application/vnd.ms-word.template.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.template.macroenabled.12: doc
|
|
- application/vnd.ms-excel: doc
|
|
- application/vnd.ms-excel.addin.macroenabled.12: doc
|
|
- application/vnd.ms-excel.sheet.binary.macroenabled.12: doc
|
|
- application/vnd.ms-excel.template.macroenabled.12: doc
|
|
- application/vnd.ms-excel.sheet.macroenabled.12: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.presentation: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.slide: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.slideshow: doc
|
|
- application/vnd.openxmlformats-officedocument.presentationml.template: doc
|
|
- application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: doc
|
|
- application/vnd.openxmlformats-officedocument.spreadsheetml.template: doc
|
|
- application/vnd.openxmlformats-officedocument.wordprocessingml.document: doc
|
|
- application/vnd.openxmlformats-officedocument.wordprocessingml.template: doc
|
|
- application/vnd.ms-powerpoint.addin.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.slide.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.presentation.macroenabled.12: doc
|
|
- application/vnd.ms-powerpoint.slideshow.macroenabled.12: doc
|
|
- application/vnd.openxmlformats-officedocument: doc
|
|
logging:
|
|
excluded:
|
|
- broker
|
|
- capture_loss
|
|
- known_hosts
|
|
- known_services
|
|
- loaded_scripts
|
|
- ntp
|
|
- packet_filter
|
|
- reporter
|
|
- stats
|
|
- stderr
|
|
- stdout
|
|
|