whitelist_scan_detection.bro

module Scan;

global whitelist_scan_port: set[port] = { } &redef;

global ephemeral_start_udp: port = secret/udp;
global ephemeral_start_tcp: port = secret/tcp;

hook scan_policy(scanner: addr, victim: addr, scanned_port: port)
{
            if (( victim in whitelist_scan_ip) || ( scanner in whitelist_scan_ip ) || ( scanned_port in whitelist_scan_port) || ( scanned_port > ephemeral_start_udp ) || ( scanned_port > ephemeral_start_tcp ))
		break;
}

whitelist_scan_detection_input.bro

module Scan;

type Idx: record {
    whitelist_ip: subnet;
};

global whitelist_scan_ip: set[subnet] = {} &synchronized;

event bro_init()
{
    Input::add_table([$source="/etc/bro/scripts/brozilla/whitelist_scan_ip.txt",
            $name="whitelist_scan_ip",
            $idx=Idx,
            $destination=whitelist_scan_ip,
            $mode=Input::REREAD]);
}