mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
Large update for the SumStats framework.
- On-demand access to sumstats results through "return from" functions named SumStats::request and Sumstats::request_key. Both functions are tested in standalone and clustered modes. - $name field has returned to SumStats which simplifies cluster code and makes the on-demand access stuff possible. - Clustered results can only be collected for 1 minute from their time of creation now instead of time of last read. - Thresholds use doubles instead of counts everywhere now. - Calculation dependency resolution occurs at start up time now instead of doing it at observation time which provide a minor cpu performance improvement. A new plugin registration mechanism was created to support this change. - AppStats now has a minimal doc string and is broken into hook-based plugins. - AppStats and traceroute detection added to local.bro
This commit is contained in:
parent
7d7d30e1f7
commit
bec965b66f
34 changed files with 687 additions and 277 deletions
|
@ -28,7 +28,7 @@ export {
|
|||
## Defines the threshold that determines if an SQL injection attack
|
||||
## is ongoing based on the number of requests that appear to be SQL
|
||||
## injection attacks.
|
||||
const sqli_requests_threshold = 50 &redef;
|
||||
const sqli_requests_threshold: double = 50.0 &redef;
|
||||
|
||||
## Interval at which to watch for the
|
||||
## :bro:id:`HTTP::sqli_requests_threshold` variable to be crossed.
|
||||
|
@ -64,11 +64,12 @@ event bro_init() &priority=3
|
|||
# determine when it looks like an actual attack and how to respond when
|
||||
# thresholds are crossed.
|
||||
local r1: SumStats::Reducer = [$stream="http.sqli.attacker", $apply=set(SumStats::SUM), $samples=collect_SQLi_samples];
|
||||
SumStats::create([$epoch=sqli_requests_interval,
|
||||
SumStats::create([$name="detect-sqli-attackers",
|
||||
$epoch=sqli_requests_interval,
|
||||
$reducers=set(r1),
|
||||
$threshold_val(key: SumStats::Key, result: SumStats::Result) =
|
||||
{
|
||||
return double_to_count(result["http.sqli.attacker"]$sum);
|
||||
return result["http.sqli.attacker"]$sum;
|
||||
},
|
||||
$threshold=sqli_requests_threshold,
|
||||
$threshold_crossed(key: SumStats::Key, result: SumStats::Result) =
|
||||
|
@ -82,11 +83,12 @@ event bro_init() &priority=3
|
|||
}]);
|
||||
|
||||
local r2: SumStats::Reducer = [$stream="http.sqli.victim", $apply=set(SumStats::SUM), $samples=collect_SQLi_samples];
|
||||
SumStats::create([$epoch=sqli_requests_interval,
|
||||
SumStats::create([$name="detect-sqli-victims",
|
||||
$epoch=sqli_requests_interval,
|
||||
$reducers=set(r2),
|
||||
$threshold_val(key: SumStats::Key, result: SumStats::Result) =
|
||||
{
|
||||
return double_to_count(result["http.sqli.victim"]$sum);
|
||||
return result["http.sqli.victim"]$sum;
|
||||
},
|
||||
$threshold=sqli_requests_threshold,
|
||||
$threshold_crossed(key: SumStats::Key, result: SumStats::Result) =
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue