Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add a new field to the notice, which defines where to send the e-mail

Browse source
This commit is contained in:
Vlad Grigorescu 2021-04-26 21:40:27 -05:00
parent 3bb4a35200
commit f8b06becd2
4 changed files with 16 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/base/frameworks/notice/actions/email_admin.zeek
View file

@ -30,11 +30,6 @@ hook notice(n: Notice::Info) &priority=-5
email = fmt("%s, %s", email, Site::get_emails(n$dst)); email = fmt("%s, %s", email, Site::get_emails(n$dst));
if ( email != "" ) if ( email != "" )
email_notice_to(n, email, T); n$email_dest = email;
} }
} }
# If hostnames.zeek was loaded first, add ourselves
@ifdef ( email_with_hostnames_types )
redef email_with_hostnames_types += { ACTION_EMAIL_ADMIN };
@endif

9
scripts/base/frameworks/notice/actions/page.zeek
View file

@ -17,13 +17,8 @@ export {
option mail_page_dest = ""; option mail_page_dest = "";
} }
hook notice(n: Notice::Info) &priority=-5 hook notice(n: Notice::Info) &priority=-6
{ {
if ( ACTION_PAGE in n$actions ) if ( ACTION_PAGE in n$actions )
email_notice_to(n, mail_page_dest, F); n$email_dest = mail_page_dest;
} }
# If hostnames.zeek was loaded first, add ourselves
@ifdef ( email_with_hostnames_types )
redef email_with_hostnames_types += { ACTION_PAGE };
@endif

10
scripts/base/frameworks/notice/main.zeek
View file

@ -136,6 +136,9 @@ export {
## The actions which have been applied to this notice. ## The actions which have been applied to this notice.
actions: ActionSet &log &default=ActionSet(); actions: ActionSet &log &default=ActionSet();
## The email address where to send this notice
email_dest: string &log &optional;
## By adding chunks of text into this element, other scripts ## By adding chunks of text into this element, other scripts
## can expand on notices that are being emailed. The normal ## can expand on notices that are being emailed. The normal
## way to add text is to extend the vector by handling the ## way to add text is to extend the vector by handling the
@ -512,8 +515,13 @@ hook Notice::policy(n: Notice::Info) &priority=10
hook Notice::notice(n: Notice::Info) &priority=-5 hook Notice::notice(n: Notice::Info) &priority=-5
{ {
if ( ACTION_EMAIL in n$actions ) # Send to requested address if set
if ( n?$email_dest )
email_notice_to(n, n$email_dest, T);
# Otherwise Send to default address
else if ( ACTION_EMAIL in n$actions )
email_notice_to(n, mail_dest, T); email_notice_to(n, mail_dest, T);
if ( ACTION_LOG in n$actions ) if ( ACTION_LOG in n$actions )
Log::write(Notice::LOG, n); Log::write(Notice::LOG, n);
if ( ACTION_ALARM in n$actions ) if ( ACTION_ALARM in n$actions )

27
scripts/policy/frameworks/notice/extend-email/hostnames.zeek
View file

@ -1,34 +1,25 @@
##! Loading this script extends the emails that Zeek sends ##! Loading this script extends the :zeek:enum:`Notice::ACTION_EMAIL` action
##! by appending to the email the hostnames associated with ##! by appending to the email the hostnames associated with
##! :zeek:type:`Notice::Info`'s *src* and *dst* fields as determined by a ##! :zeek:type:`Notice::Info`'s *src* and *dst* fields as determined by a
##! DNS lookup. This is enabled for the :zeek:enum:`Notice::ACTION_EMAIL` ##! DNS lookup.
##! action by default, and :zeek:enum:`Notice::ACTION_EMAIL_ADMIN` and
##! :zeek:enum:`Notice::ACTION_PAGE` if their scripts are loaded.
@load base/frameworks/notice/main @load base/frameworks/notice/main
module Notice; module Notice;
export {
## The Notice action types whose e-mails will be extended with hostnames.
## :zeek:see:`Notice::Action`
option email_with_hostnames_types: set[Notice::Action] = {ACTION_EMAIL};
}
# We have to store references to the notices here because the when statement # We have to store references to the notices here because the when statement
# clones the frame which doesn't give us access to modify values outside # clones the frame which doesn't give us access to modify values outside
# of it's execution scope. (we get a clone of the notice instead of a # of it's execution scope. (we get a clone of the notice instead of a
# reference to the original notice) # reference to the original notice)
global tmp_notice_storage: table[string] of Notice::Info &create_expire=max_email_delay+10secs; global tmp_notice_storage: table[string] of Notice::Info &create_expire=max_email_delay+10secs;
hook notice(n: Notice::Info) &priority=10 hook notice(n: Notice::Info) &priority=-10
{ {
if ( ! n?$src && ! n?$dst ) if ( ! n?$src && ! n?$dst )
return; return;
# This should only be done for notices that are being sent to email. # This should only be done for notices that are being sent to email.
# We calculate the intersection, and don't do anything if it's empty. if ( ! n?$email_dest )
if ( |n$actions & email_with_hostnames_types| == 0 )
return; return;
# I'm not recovering gracefully from the when statements because I want # I'm not recovering gracefully from the when statements because I want
@ -59,13 +50,3 @@ hook notice(n: Notice::Info) &priority=10
} }
} }
} }
# If page.zeek was loaded first, add that action
@ifdef ( ACTION_PAGE )
redef email_with_hostnames_types += { ACTION_PAGE };
@endif
# If email_admin.zeek was loaded first, add that action
@ifdef ( ACTION_EMAIL_ADMIN )
redef email_with_hostnames_types += { ACTION_EMAIL_ADMIN };
@endif