Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Updates to local.bro.

Browse source 
- More functionality scripts loaded from policy/.

- More documentation.
This commit is contained in:
Seth Hall 2011-08-08 13:41:21 -04:00
parent c4f4df6a79
commit 0e2a1605b3
1 changed files with 28 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

30
scripts/site/local.bro
View file

@ -1,4 +1,5 @@
##! Local site policy. Customize as appropriate. ##! Local site policy. Customize as appropriate. This file will not be
##! overwritten when upgrading or reinstalling.
# Load the script to log which script were loaded during each run # Load the script to log which script were loaded during each run
@load misc/loaded-scripts @load misc/loaded-scripts
@ -8,7 +9,8 @@
# Vulnerable versions of software to generate notices for when discovered. # Vulnerable versions of software to generate notices for when discovered.
# The default is to only monitor software found in the address space defined # The default is to only monitor software found in the address space defined
# as "local". Refer to the software framework's documentation for more information. # as "local". Refer to the software framework's documentation for more
# information.
@load frameworks/software/vulnerable @load frameworks/software/vulnerable
redef Software::vulnerable_versions += { redef Software::vulnerable_versions += {
["Flash"] = [$major=10,$minor=2,$minor2=153,$addl="1"], ["Flash"] = [$major=10,$minor=2,$minor2=153,$addl="1"],
@ -18,3 +20,27 @@ redef Software::vulnerable_versions += {
# This adds signatures to detect cleartext forward and reverse windows shells. # This adds signatures to detect cleartext forward and reverse windows shells.
redef signature_files += "frameworks/signatures/detect-windows-shells.sig"; redef signature_files += "frameworks/signatures/detect-windows-shells.sig";
# Load all of the scripts that detect software in various protocols.
@load protocols/http/software
@load protocols/ftp/software
@load protocols/smtp/software
@load protocols/ssh/software
# Load the script to detect DNS results pointing toward your Site::local_nets
# where the name is not part of your local DNS zone and is being hosted
# externally. Requires that the Site::local_zones variable is defined.
@load protocols/dns/detect-external-names
# Script to detect various activity in FTP sessions.
@load protocols/ftp/detect
# Detect software changing (e.g. attacker installing hacked SSHD).
@load frameworks/software/version-changes
# Scripts that do asset tracking.
@load protocols/conn/known-hosts
@load protocols/conn/known-services
@load protocols/ssl/known-certs
# Load the script to enable SSL/TLS certificate validation.
@load protocols/ssl/validate-certs