Skip to content

Instantly share code, notes, and snippets.

@sethhall
sethhall / corelight-logs.schema.json
Created Feb 14, 2022
Corelight Software Sensor Logs JSON Schema
View corelight-logs.schema.json
{
"$schema": "http://json-schema.org/draft-07/schema#",
"$id": "https://corelight.com/software-sensor.schema.json",
"title": "Corelight Logs",
"description": "Definition of all of the potential logs for this installation",
"definitions": {
"time": {"type": "string", "pattern": "[0-9]{4}-[0-1][0-9]-[0-3][0-9]T[0-2][0-9]:[0-5][0-9]:[0-5][0-9]\\.?[0-9]{0,6}Z"},
"port": {"type": "integer", "minimum": 0, "maximum": 65535},
"count": {"type": "integer", "minimum": 0, "maximum": 18446744073709551615},
"int": {"type": "integer", "minimum": -9223372036854775807, "maximum": 9223372036854775807},
@sethhall
sethhall / bu-everywhere.zeek
Created Dec 15, 2020
Business Unit everywhere
View bu-everywhere.zeek
##! Add Business Unit to all logs with an "id" field.
module BusinessUnit;
export {
option BusinessUnit::networks: table[subnet] of string = set();
}
redef record conn_id += {
## The business unit seen as the connection originator.
@sethhall
sethhall / gist:b23ebe5e73c9585fbbdff3628f53b6ae
Last active Dec 9, 2020
A "next interval" function from Justin Azoff
View gist:b23ebe5e73c9585fbbdff3628f53b6ae
function next_interval(i: interval): interval
{
local now = current_time();
local ii = double_to_count(interval_to_double(i));
local sofar = double_to_count(time_to_double(now)) % ii;
local togo = ii - sofar;
local dur = double_to_interval(togo);
return dur;
}
@sethhall
sethhall / mandelbrot.zeek
Created Sep 17, 2020
Mandelbrot fractal set! Probably want the script compiler for this one...
View mandelbrot.zeek
const stdout = open("/dev/stdout") &raw_output;
const WIDTH = 80;
const HEIGHT = 25;
const characters = vector(" ", ".", ":", "-", "#", "o", "*", ">");#, ")", #, "|", "&", "I", "H", "%", "*", "#");
function CalculateRow(y: double, factor: double, shiftRight: double)
{
local output: vector of string = vector();
local XCenter = -0.45;
@sethhall
sethhall / http-more-files-names.bro
Created Aug 23, 2018
Get some extra file names from http
View http-more-files-names.bro
redef record HTTP::Info += {
potential_fname: string &optional;
};
event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string) &priority=5
{
# Get rid of uri arguments
local path = split_string(c$http$uri, /\?/)[0];
@sethhall
sethhall / icmp-latency.bro
Last active Jan 2, 2016
ICMP Latency Measurement with Bro
View icmp-latency.bro
global watching_icmp: table[conn_id, count] of time &create_expire=3secs;
event icmp_echo_request(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
{
watching_icmp[c$id, seq] = network_time();
}
event icmp_echo_reply(c: connection, icmp: icmp_conn, id: count, seq: count, payload: string)
{
if ( [c$id, seq] !in watching_icmp )
@sethhall
sethhall / no-cert-parsing.bro
Last active Aug 29, 2015
Script to avoid OpenSSL DoS CVE-2015-1788
View no-cert-parsing.bro
##! This script is to avoid CVE-2015-1788 which is explained in
##! detail at http://jpb.io. It is a denial of service against
##! OpenSSL which will cause Bro processes to lock up.
##! WARNING - This script should only be used temporarily until
##! your OpenSSL library is upgraded. This script can
##! then be removed.
@if( /2\.3/ in bro_version() )
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=-100
@sethhall
sethhall / gist:6ec210d99736bd54c351
Last active Aug 29, 2015
fix issue in files framework
View gist:6ec210d99736bd54c351
diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc
index d0b1ea2..c1e5e3d 100644
--- a/src/file_analysis/File.cc
+++ b/src/file_analysis/File.cc
@@ -505,10 +505,12 @@ void File::EndOfFile()
if ( ! bof_buffer.full )
{
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] File over but bof_buffer not full.", id.c_str());
- bof_buffer.full = true;
+ bof_buffer.full = true;
@sethhall
sethhall / gif.pac2
Created Oct 20, 2014
very early gif parser for binpac++. probably doesn't even work.
View gif.pac2
module GIF;
import BinPAC;
type Header = unit {
%byteorder = BinPAC::ByteOrder::Little;
signature : bytes &length=3; #This needs to either be a literal b"GIF" or have a &check attribute when that exists
version : bytes &length=3;