mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
e382369091
* 'master' of https://github.com/sfinlon/zeek: Fix CIF integration and add logging options to intel.log and added comments to code
66 lines
1.8 KiB
Text
66 lines
1.8 KiB
Text
@load base/frameworks/intel
|
|
|
|
module Intel;
|
|
|
|
## This file adds mapping between the Collective Intelligence Framework (CIF) and Zeek.
|
|
|
|
export {
|
|
redef record Intel::MetaData += {
|
|
## Maps to the 'tags' fields in CIF
|
|
cif_tags: string &optional;
|
|
## Maps to the 'confidence' field in CIF
|
|
cif_confidence: double &optional;
|
|
## Maps to the 'source' field in CIF
|
|
cif_source: string &optional;
|
|
## Maps to the 'description' field in CIF
|
|
cif_description: string &optional;
|
|
## Maps to the 'firstseen' field in CIF
|
|
cif_firstseen: string &optional;
|
|
## Maps to the 'lastseen' field in CIF
|
|
cif_lastseen: string &optional;
|
|
};
|
|
|
|
## CIF record used for consistent formatting of CIF values.
|
|
type CIF: record {
|
|
## CIF tags observations, examples for tags are ``botnet`` or ``exploit``.
|
|
tags: string &optional &log;
|
|
## In CIF Confidence details the degree of certainty of a given observation.
|
|
confidence: double &optional &log;
|
|
## Source given in CIF.
|
|
source: string &optional &log;
|
|
## description given in CIF.
|
|
description: string &optional &log;
|
|
## First time the source observed the behavior.
|
|
firstseen: string &optional &log;
|
|
## Last time the source observed the behavior.
|
|
lastseen: string &optional &log;
|
|
};
|
|
|
|
redef record Info += {
|
|
cif: CIF &log &optional;
|
|
};
|
|
|
|
}
|
|
|
|
hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5
|
|
{
|
|
for ( item in items )
|
|
{
|
|
local tmp: CIF;
|
|
|
|
if ( item$meta?$cif_tags )
|
|
tmp$tags = item$meta$cif_tags;
|
|
if ( item$meta?$cif_confidence )
|
|
tmp$confidence = item$meta$cif_confidence;
|
|
if ( item$meta?$cif_source )
|
|
tmp$source = item$meta$cif_source;
|
|
if ( item$meta?$cif_description )
|
|
tmp$description = item$meta$cif_description;
|
|
if ( item$meta?$cif_firstseen )
|
|
tmp$firstseen = item$meta$cif_firstseen;
|
|
if ( item$meta?$cif_lastseen )
|
|
tmp$lastseen = item$meta$cif_lastseen;
|
|
|
|
info$cif = tmp;
|
|
}
|
|
}
|