Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improvements to metrics. SSH bruteforcing detection now done with metrics framework.

Browse source
This commit is contained in:
Seth Hall 2011-08-16 11:47:49 -04:00
parent 8286fdeea1
commit 82f94881c0
4 changed files with 85 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

69
scripts/base/frameworks/metrics/main.bro
View file

@ -15,6 +15,10 @@ export {
## current value to the logging stream.
const default_break_interval = 15mins &redef;
## This is the interval for how often notices will happen after they have
## already fired.
const renotice_interval = 1hr &redef;
type Index: record {
## Host is the value to which this metric applies.
host: addr &optional;
@ -56,7 +60,7 @@ export {
pred: function(index: Index): bool &optional;
## Global mask by which you'd like to aggregate traffic.
aggregation_mask: count &optional;
## This is essentially applying names to various subnets.
## This is essentially a mapping table between addresses and subnets.
aggregation_table: table[subnet] of subnet &optional;
## The interval at which the metric should be "broken" and written
## to the logging stream.
@ -69,7 +73,6 @@ export {
## A straight threshold for generating a notice.
notice_threshold: count &optional;
## A series of thresholds at which to generate notices.
## TODO: This is not implemented yet!
notice_thresholds: vector of count &optional;
## If this and a $notice_threshold value are set, this notice type
## will be generated by the metrics framework.
@ -78,10 +81,11 @@ export {
global add_filter: function(id: ID, filter: Filter);
global add_data: function(id: ID, index: Index, increment: count);
global index2str: function(index: Index): string;
# This is the event that is used to "finish" metrics and adapt the metrics
# framework for clustered or non-clustered usage.
global log_it: event(filter: Filter);
global log_it: event(filter: Filter);
global log_metrics: event(rec: Info);
}
@ -98,39 +102,58 @@ type MetricTable: table[Index] of count &default=0;
global store: table[ID, string] of MetricTable = table();
# This stores the current threshold index for filters using the
# $notice_thresholds element.
global thresholds: table[string] of count = {} &default=0;
# $notice_threshold and $notice_thresholds elements.
global thresholds: table[ID, string, Index] of count = {} &create_expire=renotice_interval &default=0;
event bro_init() &priority=5
{
Log::create_stream(METRICS, [$columns=Info, $ev=log_metrics]);
}
function index2str(index: Index): string
{
local out = "";
if ( index?$host )
out = fmt("%shost=%s", out, index$host);
if ( index?$network )
out = fmt("%s%snetwork=%s", out, |out|==0 ? "" : ", ", index$network);
if ( index?$str )
out = fmt("%s%sstr=%s", out, |out|==0 ? "" : ", ", index$str);
return fmt("metric_index(%s)", out);
}
function write_log(ts: time, filter: Filter, data: MetricTable)
{
for ( index in data )
{
local val = data[index];
local m: Info = [$ts=ts,
local m: Info = [$ts=ts,
$metric_id=filter$id,
$filter_name=filter$name,
$index=index,
$value=val];
if ( m$index?$host &&
filter?$notice_threshold &&
m$value >= filter$notice_threshold )
if ( (filter?$notice_threshold &&
m$value >= filter$notice_threshold &&
[filter$id, filter$name, index] !in thresholds) ||
(filter?$notice_thresholds &&
|filter$notice_thresholds| <= thresholds[filter$id, filter$name, index] &&
m$value >= filter$notice_thresholds[thresholds[filter$id, filter$name, index]]) )
{
NOTICE([$note=filter$note,
$msg=fmt("Metrics threshold crossed by %s %d/%d", index$host, m$value, filter$notice_threshold),
$src=m$index$host, $n=m$value,
$metric_index=index]);
}
else if ( filter?$notice_thresholds &&
m$value >= filter$notice_thresholds[thresholds[cat(filter$id,filter$name)]] )
{
# TODO: implement this
local n: Notice::Info = [$note=filter$note, $n=m$value, $metric_index=index];
n$msg = fmt("Metrics threshold crossed by %s %d/%d", index2str(index), m$value, filter$notice_threshold);
if ( m$index?$str )
n$sub = m$index$str;
if ( m$index?$host )
n$src = m$index$host;
# TODO: not sure where to put the network yet.
NOTICE(n);
# This just needs set to some value so that it doesn't refire the
# notice until it expires from the table or it cross the next
# threshold in the case of vectors of thesholds.
++thresholds[filter$id, filter$name, index];
}
if ( filter$log )
@ -193,7 +216,6 @@ function add_data(id: ID, index: Index, increment: count)
! filter$pred(index) )
next;
local filt_store = store[id, filter$name];
if ( index?$host )
{
if ( filter?$aggregation_mask )
@ -208,8 +230,9 @@ function add_data(id: ID, index: Index, increment: count)
}
}
if ( index !in filt_store )
filt_store[index] = 0;
filt_store[index] += increment;
local metric_tbl = store[id, filter$name];
if ( index !in metric_tbl )
metric_tbl[index] = 0;
metric_tbl[index] += increment;
}
}

4
scripts/base/frameworks/metrics/non-cluster.bro
View file

@ -1,10 +1,6 @@
module Metrics;
export {
}
event Metrics::log_it(filter: Filter)
{
local id = filter$id;