whitelist_scan_detection.zeek

module Scan;

global whitelist_scan_port: set[port] = {5223/udp, 5223/tcp} &redef;

global ephemeral_start_udp: port = 32768/udp;
global ephemeral_start_tcp: port = 32768/tcp;

hook scan_policy(scanner: addr, victim: addr, scanned_port: port)
{
            if (( victim in whitelist_scan_ip) || ( scanner in whitelist_scan_ip ) || ( scanned_port in whitelist_scan_port) || ( scanned_port > ephemeral_start_udp ) || ( scanned_port > ephemeral_start_tcp ))
		break;
}

whitelist_scan_detection_input.zeek

module Scan;

type Idx: record {
    whitelist_ip: subnet;
};

global whitelist_scan_ip: set[subnet] = {};

event zeek_init()
{
    Input::add_table([$source="/etc/zeek/scripts/zeekzilla/whitelist_scan_ip.txt",
            $name="whitelist_scan_ip",
            $idx=Idx,
            $destination=whitelist_scan_ip,
            $mode=Input::REREAD]);
}