mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
1bd658da8f
This adds a "policy" hook into the logging framework's streams and
filters to replace the existing log filter predicates. The hook
signature is as follows:
hook(rec: any, id: Log::ID, filter: Log::Filter);
The logging manager invokes hooks on each log record. Hooks can veto
log records via a break, and modify them if necessary. Log filters
inherit the stream-level hook, but can override or remove the hook as
needed.
The distribution's existing log streams now come with pre-defined
hooks that users can add handlers to. Their name is standardized as
"log_policy" by convention, with additional suffixes when a module
provides multiple streams. The following adds a handler to the Conn
module's default log policy hook:
hook Conn::log_policy(rec: Conn::Info, id: Log::ID, filter: Log::Filter)
{
if ( some_veto_reason(rec) )
break;
}
By default, this handler will get invoked for any log filter
associated with the Conn::LOG stream.
The existing predicates are deprecated for removal in 4.1 but continue
to work.
61 lines
2 KiB
Text
61 lines
2 KiB
Text
##! This script lets Barnyard2 integrate with Zeek. It receives alerts from
|
|
##! Barnyard2 and logs them. In the future it will do more correlation
|
|
##! and derive new notices from the alerts.
|
|
|
|
@load ./types
|
|
|
|
module Barnyard2;
|
|
|
|
export {
|
|
redef enum Log::ID += { LOG };
|
|
|
|
global log_policy: Log::PolicyHook;
|
|
|
|
type Info: record {
|
|
## Timestamp of the alert.
|
|
ts: time &log;
|
|
## Associated packet ID.
|
|
pid: PacketID &log;
|
|
## Associated alert data.
|
|
alert: AlertData &log;
|
|
};
|
|
|
|
## This can convert a Barnyard :zeek:type:`Barnyard2::PacketID` value to
|
|
## a :zeek:type:`conn_id` value in the case that you might need to index
|
|
## into an existing data structure elsewhere within Zeek.
|
|
global pid2cid: function(p: PacketID): conn_id;
|
|
}
|
|
|
|
event zeek_init() &priority=5
|
|
{
|
|
Log::create_stream(Barnyard2::LOG, [$columns=Info, $path="barnyard2", $policy=log_policy]);
|
|
}
|
|
|
|
|
|
function pid2cid(p: PacketID): conn_id
|
|
{
|
|
return [$orig_h=p$src_ip, $orig_p=p$src_p, $resp_h=p$dst_ip, $resp_p=p$dst_p];
|
|
}
|
|
|
|
event barnyard_alert(id: PacketID, alert: AlertData, msg: string, data: string)
|
|
{
|
|
Log::write(Barnyard2::LOG, [$ts=network_time(), $pid=id, $alert=alert]);
|
|
|
|
#local proto_connection_string: string;
|
|
#if ( id$src_p == 0/tcp )
|
|
# proto_connection_string = fmt("{PROTO:255} %s -> %s", id$src_ip, id$dst_ip);
|
|
#else
|
|
# proto_connection_string = fmt("{%s} %s:%d -> %s:%d",
|
|
# to_upper(fmt("%s", get_port_transport_proto(id$dst_p))),
|
|
# id$src_ip, id$src_p, id$dst_ip, id$dst_p);
|
|
#
|
|
#local snort_alike_msg = fmt("%.6f [**] [%d:%d:%d] %s [**] [Classification: %s] [Priority: %d] %s",
|
|
# sad$ts,
|
|
# sad$generator_id,
|
|
# sad$signature_id,
|
|
# sad$signature_revision,
|
|
# msg,
|
|
# sad$classification,
|
|
# sad$priority_id,
|
|
# proto_connection_string);
|
|
}
|