mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 10:38:20 +00:00
Change doc/ subdir into a git submodule
The docs now live at https://github.com/zeek/zeek-docs
This commit is contained in:
Jon Siwek
parent
0d685efbf5
commit
2ff746fea7
693 changed files with 26 additions and 105609 deletions
|
|
@ -1,45 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
policy/frameworks/software/version-changes.bro
|
||||
==============================================
|
||||
.. bro:namespace:: Software
|
||||
|
||||
Provides the possibility to define software names that are interesting to
|
||||
watch for changes. A notice is generated if software versions change on a
|
||||
host.
|
||||
|
||||
:Namespace: Software
|
||||
:Imports: :doc:`base/frameworks/notice </scripts/base/frameworks/notice/index>`, :doc:`base/frameworks/software </scripts/base/frameworks/software/index>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
=================================================================================== ====================================================================
|
||||
:bro:id:`Software::interesting_version_changes`: :bro:type:`set` :bro:attr:`&redef` Some software is more interesting when the version changes and this
|
||||
is a set of all software that should raise a notice when a different
|
||||
version is seen on a host.
|
||||
=================================================================================== ====================================================================
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
========================================== =
|
||||
:bro:type:`Notice::Type`: :bro:type:`enum`
|
||||
========================================== =
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
.. bro:id:: Software::interesting_version_changes
|
||||
|
||||
:Type: :bro:type:`set` [:bro:type:`string`]
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``{}``
|
||||
|
||||
Some software is more interesting when the version changes and this
|
||||
is a set of all software that should raise a notice when a different
|
||||
version is seen on a host.
|
||||
|
||||
|
||||
|
|
@ -1,99 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
policy/frameworks/software/vulnerable.bro
|
||||
=========================================
|
||||
.. bro:namespace:: Software
|
||||
|
||||
Provides a variable to define vulnerable versions of software and if
|
||||
a version of that software is as old or older than the defined version a
|
||||
notice will be generated.
|
||||
|
||||
:Namespace: Software
|
||||
:Imports: :doc:`base/frameworks/control </scripts/base/frameworks/control/index>`, :doc:`base/frameworks/notice </scripts/base/frameworks/notice/index>`, :doc:`base/frameworks/software </scripts/base/frameworks/software/index>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
================================================================================================ =============================================================
|
||||
:bro:id:`Software::vulnerable_versions_update_endpoint`: :bro:type:`string` :bro:attr:`&redef` The DNS zone where runtime vulnerable software updates will
|
||||
be loaded from.
|
||||
:bro:id:`Software::vulnerable_versions_update_interval`: :bro:type:`interval` :bro:attr:`&redef` The interval at which vulnerable versions should grab updates
|
||||
over DNS.
|
||||
================================================================================================ =============================================================
|
||||
|
||||
Redefinable Options
|
||||
###################
|
||||
============================================================================= ===============================================================
|
||||
:bro:id:`Software::vulnerable_versions`: :bro:type:`table` :bro:attr:`&redef` This is a table of software versions indexed by the name of the
|
||||
software and a set of version ranges that are declared to be
|
||||
vulnerable for that software.
|
||||
============================================================================= ===============================================================
|
||||
|
||||
Types
|
||||
#####
|
||||
================================================================ =
|
||||
:bro:type:`Software::VulnerableVersionRange`: :bro:type:`record`
|
||||
================================================================ =
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
========================================== =
|
||||
:bro:type:`Notice::Type`: :bro:type:`enum`
|
||||
========================================== =
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
.. bro:id:: Software::vulnerable_versions_update_endpoint
|
||||
|
||||
:Type: :bro:type:`string`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``""``
|
||||
|
||||
The DNS zone where runtime vulnerable software updates will
|
||||
be loaded from.
|
||||
|
||||
.. bro:id:: Software::vulnerable_versions_update_interval
|
||||
|
||||
:Type: :bro:type:`interval`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``1.0 hr``
|
||||
|
||||
The interval at which vulnerable versions should grab updates
|
||||
over DNS.
|
||||
|
||||
Redefinable Options
|
||||
###################
|
||||
.. bro:id:: Software::vulnerable_versions
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`string`] of :bro:type:`set` [:bro:type:`Software::VulnerableVersionRange`]
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``{}``
|
||||
|
||||
This is a table of software versions indexed by the name of the
|
||||
software and a set of version ranges that are declared to be
|
||||
vulnerable for that software.
|
||||
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: Software::VulnerableVersionRange
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
min: :bro:type:`Software::Version` :bro:attr:`&optional`
|
||||
The minimal version of a vulnerable version range. This
|
||||
field can be undefined if all previous versions of a piece
|
||||
of software are vulnerable.
|
||||
|
||||
max: :bro:type:`Software::Version`
|
||||
The maximum vulnerable version. This field is deliberately
|
||||
not optional because a maximum vulnerable version must
|
||||
always be defined. This assumption may become incorrect
|
||||
if all future versions of some software are to be considered
|
||||
vulnerable. :)
|
||||
|
||||
|
||||
|
||||
|
|
@ -1,89 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
policy/frameworks/software/windows-version-detection.bro
|
||||
========================================================
|
||||
.. bro:namespace:: OS
|
||||
|
||||
Windows systems access a Microsoft Certificate Revocation List (CRL) periodically. The
|
||||
user agent for these requests reveals which version of Crypt32.dll installed on the system,
|
||||
which can uniquely identify the version of Windows that's running.
|
||||
|
||||
This script will log the version of Windows that was identified to the Software framework.
|
||||
|
||||
:Namespace: OS
|
||||
:Imports: :doc:`base/frameworks/software </scripts/base/frameworks/software/index>`, :doc:`base/protocols/http </scripts/base/protocols/http/index>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Redefinable Options
|
||||
###################
|
||||
====================================================================== =
|
||||
:bro:id:`OS::crypto_api_mapping`: :bro:type:`table` :bro:attr:`&redef`
|
||||
====================================================================== =
|
||||
|
||||
Types
|
||||
#####
|
||||
========================================================== =
|
||||
:bro:type:`Software::name_and_version`: :bro:type:`record`
|
||||
========================================================== =
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
============================================ =
|
||||
:bro:type:`Software::Type`: :bro:type:`enum`
|
||||
============================================ =
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Redefinable Options
|
||||
###################
|
||||
.. bro:id:: OS::crypto_api_mapping
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`string`] of :bro:type:`Software::name_and_version`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default:
|
||||
|
||||
::
|
||||
|
||||
{
|
||||
["Microsoft-CryptoAPI/5.131.3790.1830"] = [name="Windows", version=[major=5, minor=131, minor2=3790, minor3=1830, addl="XP x64 or Server 2003 SP1"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3205"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3205, addl="XP SP3 Beta 2"]],
|
||||
["Microsoft-CryptoAPI/6.1"] = [name="Windows", version=[major=6, minor=1, minor2=<uninitialized>, minor3=<uninitialized>, addl="7 or Server 2008 R2"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.2180"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=2180, addl="XP SP2"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.5508"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=5508, addl="XP SP3 RC2 Update 2"]],
|
||||
["Microsoft-CryptoAPI/5.131.3790.0"] = [name="Windows", version=[major=5, minor=131, minor2=3790, minor3=0, addl="XP x64 or Server 2003 SP0"]],
|
||||
["Microsoft-CryptoAPI/6.0"] = [name="Windows", version=[major=6, minor=0, minor2=<uninitialized>, minor3=<uninitialized>, addl="Vista or Server 2008"]],
|
||||
["Microsoft-CryptoAPI/5.131.2195.6661"] = [name="Windows", version=[major=5, minor=131, minor2=2195, minor3=6661, addl="2000 SP4"]],
|
||||
["Microsoft-CryptoAPI/5.131.3790.5235"] = [name="Windows", version=[major=5, minor=131, minor2=3790, minor3=5235, addl="XP x64 or Server 2003 with MS13-095"]],
|
||||
["Microsoft-CryptoAPI/6.4"] = [name="Windows", version=[major=6, minor=4, minor2=<uninitialized>, minor3=<uninitialized>, addl="10 Technical Preview"]],
|
||||
["Microsoft-CryptoAPI/6.2"] = [name="Windows", version=[major=6, minor=2, minor2=<uninitialized>, minor3=<uninitialized>, addl="8 or Server 2012"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.1106"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=1106, addl="XP SP1"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3311"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3311, addl="XP SP3 RC2 Update"]],
|
||||
["Microsoft-CryptoAPI/10.0"] = [name="Windows", version=[major=10, minor=0, minor2=<uninitialized>, minor3=<uninitialized>, addl=<uninitialized>]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3180"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3180, addl="XP SP3 Beta 1"]],
|
||||
["Microsoft-CryptoAPI/5.131.3790.3959"] = [name="Windows", version=[major=5, minor=131, minor2=3790, minor3=3959, addl="XP x64 or Server 2003 SP2"]],
|
||||
["Microsoft-CryptoAPI/6.3"] = [name="Windows", version=[major=6, minor=3, minor2=<uninitialized>, minor3=<uninitialized>, addl="8.1 or Server 2012 R2"]],
|
||||
["Microsoft-CryptoAPI/5.131.2195.6824"] = [name="Windows", version=[major=5, minor=131, minor2=2195, minor3=6824, addl="2000 with MS04-11"]],
|
||||
["Microsoft-CryptoAPI/5.131.2195.6926"] = [name="Windows", version=[major=5, minor=131, minor2=2195, minor3=6926, addl="2000 with Hotfix 98830"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3282"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3282, addl="XP SP3 RC1 Update"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3300"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3300, addl="XP SP3 RC2"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3264"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3264, addl="XP SP3 RC1"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.5512"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=5512, addl="XP SP3"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.0"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=0, addl="XP SP0"]],
|
||||
["Microsoft-CryptoAPI/5.131.2600.3249"] = [name="Windows", version=[major=5, minor=131, minor2=2600, minor3=3249, addl="XP SP3 RC Beta"]]
|
||||
}
|
||||
|
||||
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: Software::name_and_version
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
name: :bro:type:`string`
|
||||
|
||||
version: :bro:type:`Software::Version`
|
||||
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue