This script enables easy customation of how notice actions are handled. It's built to work with eZeekConfigurator, but that isn't required and can be configured with a normal script.
Notices can be configured with five different "actions", some of which correspond to Zeek internal Notice::ACTION types.
LOG - (default) Sets Notice::ACTION_LOG which logs to notice.log
IGNORE - Ignores the notice and won't even log it.
ALARM -Sets Notice::ACTION_ALARM which logs to notice-alarm.log
PAGE - Sets Notice::ACTION_PAGE which you can handle how you see fit
BHR - Sets Notice::ACTION_BHR (not built in) which you can handle later.
This will only be set if Notice::ACTION_BHR has been previously defined.
Note, the current commonly used BHR scripts also set ACTION_BHR, but do not process a black hole route based on that action existing.
There are no plans to support ACTION_EMAIL because we believe email is a horrible way to alert enginners to a problem.
Each notice configuration element is built from an NC_Info record consisting of up to four pieces of information:
$src: A set of source subnets that will be matched against the notice src.
$src_in: A set of strings containing variable names whose contents will be
matched against the notice src. For instance, you can match
against "Site::local_nets" without having the duplicate the source
nets.
$note: A set of Notice::Types to match against.
$action: A set of the above available notice-config actions
The notice_cfg itself is a vector of NC_Info. This means it is ordered and the first match will be processed for each notice.
An example configuration that will whitelist scan notices for local_nets and then BHR the rest:
module Notice;
notice_cfg += NC_Info($src_in=set("Site::local_nets"),
$note=set(Scan::Address_Scan),
$action=set(IGNORE));
notice_cfg += NC_Info($note=set(Scan::Address_Scan),
$action=set(LOG,BHR));
Since all of the items in NC_Info are sets, we can do the same thing with port scans by modifying those same lines and not having to duplicate everything:
module Notice;
notice_cfg += NC_Info($src_in=set("Site::local_nets"),
$note=set(Scan::Address_Scan, Scan::Port_Scan),
$action=set(IGNORE));
notice_cfg += NC_Info($note=set(Scan::Address_Scan, Scan::Port_Scan),
$action=set(LOG,BHR));
If you also want to perform specific actions based on the Notice actions you've set, a custom script can be written to handle those. For example, here is a skeleton for handling Notice::ACTION_PAGE:
module Notice;
export {
## Timeout for when() call when paging
option page_timeout: interval=3 sec;
}
hook Notice::policy(n: Notice::Info) &priority=5 {
if(Notice::ACTION_PAGE in n$actions){
when ( local result = Exec::run([$cmd=SOME_COMMAND])){
print fmt("%s",result$stdout[0]);
}timeout page_timeout{
print(fmt("Couldn't page for some reason. %s",alert_type));
}
}
}