mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
0cc3e574f0
* origin/topic/johanna/x509-cn: Use our new features to send the CN and SAN fields of certificates to the intel framework. Do not log common name by default (it is most interesting for scripts) and add a test case. extract most specific common name from certificates BIT-1323 #merged
28 lines
679 B
Text
28 lines
679 B
Text
@load base/frameworks/intel
|
|
@load base/files/x509
|
|
@load ./where-locations
|
|
|
|
event x509_ext_subject_alternative_name(f: fa_file, ext: X509::SubjectAlternativeName)
|
|
{
|
|
if ( ext?$dns )
|
|
{
|
|
for ( i in ext$dns )
|
|
Intel::seen([$indicator=ext$dns[i],
|
|
$indicator_type=Intel::DOMAIN,
|
|
$f=f,
|
|
$where=X509::IN_CERT]);
|
|
}
|
|
}
|
|
|
|
event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate)
|
|
{
|
|
if ( /emailAddress=/ in cert$subject )
|
|
{
|
|
local email = sub(cert$subject, /^.*emailAddress=/, "");
|
|
email = sub(email, /,.*$/, "");
|
|
Intel::seen([$indicator=email,
|
|
$indicator_type=Intel::EMAIL,
|
|
$f=f,
|
|
$where=X509::IN_CERT]);
|
|
}
|
|
}
|