Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Remove barnyard2 integration scripts

Browse source
This commit is contained in:
Arne Welzel 2022-08-19 11:11:04 +02:00
parent b20f2b5b98
commit 78beecf37d
8 changed files with 9 additions and 101 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/policy/integration/barnyard2/README
View file

@ -1 +0,0 @@
Integration with Barnyard2.

2
scripts/policy/integration/barnyard2/__load__.zeek
View file

@ -1,2 +0,0 @@
@load ./types
@load ./main

61
scripts/policy/integration/barnyard2/main.zeek
View file

@ -1,61 +0,0 @@
##! This script lets Barnyard2 integrate with Zeek. It receives alerts from
##! Barnyard2 and logs them. In the future it will do more correlation
##! and derive new notices from the alerts.
@load ./types
module Barnyard2;
export {
redef enum Log::ID += { LOG };
global log_policy: Log::PolicyHook;
type Info: record {
## Timestamp of the alert.
ts: time &log;
## Associated packet ID.
pid: PacketID &log;
## Associated alert data.
alert: AlertData &log;
};
## This can convert a Barnyard :zeek:type:`Barnyard2::PacketID` value to
## a :zeek:type:`conn_id` value in the case that you might need to index
## into an existing data structure elsewhere within Zeek.
global pid2cid: function(p: PacketID): conn_id;
}
event zeek_init() &priority=5
{
Log::create_stream(Barnyard2::LOG, [$columns=Info, $path="barnyard2", $policy=log_policy]);
}
function pid2cid(p: PacketID): conn_id
{
return [$orig_h=p$src_ip, $orig_p=p$src_p, $resp_h=p$dst_ip, $resp_p=p$dst_p];
}
event barnyard_alert(id: PacketID, alert: AlertData, msg: string, data: string)
{
Log::write(Barnyard2::LOG, [$ts=network_time(), $pid=id, $alert=alert]);
#local proto_connection_string: string;
#if ( id$src_p == 0/tcp )
# proto_connection_string = fmt("{PROTO:255} %s -> %s", id$src_ip, id$dst_ip);
#else
# proto_connection_string = fmt("{%s} %s:%d -> %s:%d",
# to_upper(fmt("%s", get_port_transport_proto(id$dst_p))),
# id$src_ip, id$src_p, id$dst_ip, id$dst_p);
#
#local snort_alike_msg = fmt("%.6f [**] [%d:%d:%d] %s [**] [Classification: %s] [Priority: %d] %s",
# sad$ts,
# sad$generator_id,
# sad$signature_id,
# sad$signature_revision,
# msg,
# sad$classification,
# sad$priority_id,
# proto_connection_string);
}

32
scripts/policy/integration/barnyard2/types.zeek
View file

@ -1,32 +0,0 @@
##! This file is separate from the base script so that dependencies can
##! be loaded in the correct order.
module Barnyard2;
export {
type AlertData: record {
sensor_id: count; ##< Sensor that originated this event.
ts: time; ##< Timestamp attached to the alert.
signature_id: count; ##< Sig id for this generator.
generator_id: count; ##< Which generator generated the alert?
signature_revision: count; ##< Sig revision for this id.
classification_id: count; ##< Event classification.
classification: string; ##< Descriptive classification string.
priority_id: count; ##< Event priority.
event_id: count; ##< Event ID.
} &log;
type PacketID: record {
src_ip: addr;
src_p: port;
dst_ip: addr;
dst_p: port;
} &log;
## This is the event that Barnyard2 instances will send if they're
## configured with the bro_alert output plugin.
global barnyard_alert: event(id: Barnyard2::PacketID,
alert: Barnyard2::AlertData,
msg: string,
data: string);
}

3
scripts/test-all-policy.zeek
View file

@ -73,9 +73,6 @@
@load frameworks/software/vulnerable.zeek
@load frameworks/software/windows-version-detection.zeek
@load frameworks/telemetry/log.zeek
@load integration/barnyard2/__load__.zeek
@load integration/barnyard2/main.zeek
@load integration/barnyard2/types.zeek
@load integration/collective-intel/__load__.zeek
@load integration/collective-intel/main.zeek
@load misc/capture-loss.zeek