Each key must be unique and is terminated with a colon :.
For IP addresses the dot notation is used for subnet matches:
key
CIDR
Possible matches
192.168.:
192.168.0.0/16
192.168.0.0 - 192.168.255.255
172.16.19.:
172.16.19.0/24
172.16.19.0 - 172.16.19.255
10.1.1.1:
10.1.1.1/32
10.1.1.1
1 2 3
$ vim /var/ossec/etc/lists/private_ip
10.168.:PrivateNet
Since Wazuh v3.11.3, CDB lists are built and loaded automatically when the analysis engine is started. Therefore, when adding or modifying CDB lists, it is no longer needed to run ossec-makelists, just restart the manager.
# This file is where you define your pipelines. You can define multiple. # For more information on multiple pipelines, see the documentation: # https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html
# Define your item pipelines here # # Don't forget to add your pipeline to the ITEM_PIPELINES setting # See: https://doc.scrapy.org/en/latest/topics/item-pipeline.html
from tb.items import RedisItem from tb.items import ElasticSearchItem
classRedisPipeline(object): defprocess_item(self, item, spider): ifisinstance(item, RedisItem): # to do something return item
classElasticPipeline(object): defprocess_item(self, item, spider): ifisinstance(item, ElasticSearchItem): # to do something return item
Keyspace notifications are implemented sending two distinct type of events for every operation affecting the Redis data space. For instance a DEL operation targeting the key named mykey in database 0 will trigger the delivering of two messages, exactly equivalent to the following two PUBLISH commands:
1 2
PUBLISH __keyspace@0__:mykey del PUBLISH __keyevent@0__:del mykey
By default keyspace events notifications are disabled because while not very sensible the feature uses some CPU power. Notifications are enabled using the notify-keyspace-events of redis.conf or via the CONFIG SET.
# Automatically created by: scrapy startproject # # For more information about the [deploy] section see: # https://scrapyd.readthedocs.io/en/latest/deploy.html
# Solr POST RCE CVE-2019-0193 alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL RULES EXPLOIT Solr RCE CVE-2019-0193 POST"; flow:to_server,established; flowbits:set,CVE-2019-0193.post.request; content:"POST"; http_method; fast_pattern; content:"/solr"; http_uri; content:"/config"; http_uri; content:"params.resource.loader.enabled"; http_client_body; classtype:shellcode-detect; sid:3020016; rev:1; metadata:attack_target web_server, signature_severity Critical, direction outside_to_inside, created_at 2019_10_31, updated_at 2019_10_31, author Canon, tag RCE, tag CVE-2019-0193, tag http, tag exploit, tag Solr;)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL RULES EXPLOIT Solr RCE CVE-2019-0193 POST Successful"; flow:from_server,established; flowbits:isset,CVE-2019-0193.post.request; content:"200"; http_stat_code; classtype:shellcode-detect; sid:3020017; rev:1; metadata:attack_target web_server, signature_severity Critical, direction outside_to_inside, created_at 2019_10_31, updated_at 2019_10_31, author Canon, tag RCE, tag CVE-2019-0193, tag http, tag exploit, tag Solr;)
# Solr GET RCE CVE-2019-0193 alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL RULES EXPLOIT Solr RCE CVE-2019-0193 GET"; flow:to_server,established; flowbits:set,CVE-2019-0193.get.request; content:"GET"; http_method; content:"/solr"; http_uri; fast_pattern; content:"/select?"; http_uri; content:"wt=velocity"; http_uri; content:"java.lang.Runtime"; http_uri; content:"getRuntime().exec"; http_uri; classtype:shellcode-detect; sid:3020018; rev:1; metadata:attack_target web_server, signature_severity Critical, direction outside_to_inside, created_at 2019_10_31, updated_at 2019_10_31, author Canon, tag RCE, tag CVE-2019-0193, tag http, tag exploit, tag Solr;)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"LOCAL RULES EXPLOIT Solr RCE CVE-2019-0193 GET Successful"; flow:from_server,established; flowbits:isset,CVE-2019-0193.get.request; content:"200"; http_stat_code; classtype:shellcode-detect; sid:3020019; rev:1; metadata:attack_target web_server, signature_severity Critical, direction outside_to_inside, created_at 2019_10_31, updated_at 2019_10_31, author Canon, tag RCE, tag CVE-2019-0193, tag http, tag exploit, tag Solr;)
$ ll /usr/local/share/lua/5.1/ total 72 drwxr-xr-x 3 root root 4096 Oct 25 03:35 ./ drwxr-xr-x 3 root root 4096 Sep 17 14:14 ../ -rw-r--r-- 1 root root 8331 Oct 25 03:34 ltn12.lua -rw-r--r-- 1 root root 2487 Oct 25 03:34 mime.lua -rw-r--r-- 1 root root 35599 Oct 25 03:35 redis.lua drwxr-xr-x 2 root root 4096 Oct 25 03:34 socket/ -rw-r--r-- 1 root root 4451 Oct 25 03:34 socket.lua
安装成功后, 可以简单的测试一下。
利用Docker启动Redis容器
1
$ docker run -ti -d -p 6379:6379 redis
测试脚本hello_redis.lua
1 2 3 4 5 6 7 8 9 10 11 12 13
local redis = require"redis"
local client = redis.connect("127.0.0.1", 6379)
local response = client:ping() if response == falsethen return0 end
client:set("hello", "world")
local var = client:get("hello") print(var)
可能会存在环境变量不对导致的报错
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
$ luajit hello_redis.lua luajit: /usr/local/share/lua/5.1/redis.lua:793: module 'socket' not found: no field package.preload['socket'] no file './socket.lua' no file '/usr/local/share/luajit-2.0.5/socket.lua' no file '/usr/local/share/lua/5.1/socket.lua' no file '/usr/local/share/lua/5.1/socket/init.lua' no file './socket.so' no file '/usr/local/lib/lua/5.1/socket.so' no file '/usr/local/lib/lua/5.1/loadall.so' stack traceback: [C]: infunction'require' /usr/local/share/lua/5.1/redis.lua:793: infunction'create_connection' /usr/local/share/lua/5.1/redis.lua:836: infunction'connect' a.lua:3: in main chunk [C]: at 0x56508049e440
执行luarocks path --bin 并将结果输入
1 2 3 4 5
$ luarocks path --bin Warning: The directory '/home/canon/.cache/luarocks' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing /usr/local/bin/luarocks with sudo, you may want sudo's -H flag. export LUA_PATH='/home/canon/.luarocks/share/lua/5.1/?.lua;/home/canon/.luarocks/share/lua/5.1/?/init.lua;/usr/local/share/lua/5.1/?.lua;/usr/local/share/lua/5.1/?/init.lua;./?.lua;/usr/local/share/luajit-2.0.5/?.lua' export LUA_CPATH='/home/canon/.luarocks/lib/lua/5.1/?.so;/usr/local/lib/lua/5.1/?.so;./?.so;/usr/local/lib/lua/5.1/loadall.so' export PATH='/home/canon/.luarocks/bin:/usr/local/bin:/home/canon/anaconda3/bin:/home/canon/anaconda3/condabin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin'
-- defind functioin functionmd5Encode(args) m = md5.new() m:update(args) return md5.tohex(m:finish()) end
functionformatStr(args) t = {} ios = string.match(args, 'canon') if ios ~= nilthen mail = 'email"%s+(.-)%s' t['email'] = string.match(args, mail) else data = string.split(args, '&') for n, v inipairs(data) do d = string.split(v, '=') t[d[1]] = d[2] end end return t end
functionstring.split(s, p) rt = {} string.gsub(s, '[^'..p..']+', function(w)table.insert(rt, w) end ) return rt end
-- default function functioninit(args) local needs = {} needs["protocol"] = "http" return needs end
functionsetup(args) filename = SCLogPath() .. "/" .. name file = assert(io.open(filename, "a")) SCLogInfo("app_login_audit filename: " .. filename) http = 0 -- Connect Redis Server SCLogInfo("Connect Redis Server...") client = redis.connect(host, port) response = client:ping() if response then SCLogInfo("Redis Server connection succeeded.") end end
functionlog(args) -- init tables http_table = {}
-- ti tables ti = { tags = {} }
-- init score score = 50
-- http_hostname & http_url http_hostname = HttpGetRequestHost() http_url = HttpGetRequestUriNormalized() -- http_method rl = HttpGetRequestLine() if rl then http_method = string.match(rl, "%w+") if http_method then http_table["method"] = http_method end end -- 为了保证 Suricata 的性能不受影响, 严格控制过滤条件 if http_url == login_url and http_method == "POST"then http_table["hostname"] = http_hostname http_table["url"] = http_url http_table["url_path"] = http_url -- http_status & http_protocol rsl = HttpGetResponseLine() if rsl then status_code = string.match(rsl, "%s(%d+)%s") http_table["status"] = tonumber(status_code)
http_protocol = string.match(rsl, "(.-)%s") http_table["protocol"] = http_protocol end
-- login_results a, o, e = HttpGetResponseBody() if a then for n, v inipairs(a) do body = json.decode(v) results_code = tonumber(body["code"]) if results_code == success_code then http_table["results"] = "success" else http_table["results"] = "failed" end end http_table["results_code"] = results_code end --[[ 1. 获取用户登录email 并查询 Redis中是否存在该账号 2. 根据结果进行相应的打分以及tags标注 ]] -- a, o, e = HttpGetRequestBody() if a then for n, v inipairs(a) do res = formatStr(v) if res["email"] then -- 查询Redis对比黑名单 black_ioc = client:get(res["email"]) if black_ioc then ti["provider"] = "Canon" ti["producer"] = "NTA" table.insert(ti["tags"], "account in blacklist") score = score + 10 end end end end
-- RequestHeaders rh = HttpGetRequestHeaders() if rh then for k, v inpairs(rh) do key = string.lower(k) request_var = request_mapping_table[key] if request_var then http_table[request_var] = v end end end
-- ResponseHeaders rsh = HttpGetResponseHeaders() if rsh then for k, v inpairs(rsh) do key = string.lower(k) response_var = response_mapping_table[key] if response_var then http_table[response_var] = v end end end
For example, if an 8996 byte packet is mirrored, and the traffic mirror target MTU value is 9001 bytes, the mirror encapsulation results in the mirrored packet being greater than the MTU value. In this case, the mirror packet is truncated. To prevent mirror packets from being truncated, set the traffic mirror source interface MTU value to 54 bytes less than the traffic mirror target MTU value. For more information about configuring the network MTU value, see Network Maximum Transmission Unit (MTU) for Your EC2 Instance in the Amazon EC2 User Guide for Linux Instances.
一般来说，降低 MTU 的话，有可能发现网路传输效能有下降，这是因为每个封包 size 变小，所以传送同样的资料量，封包数就会变多，造成 overhead 变多。但是对于传输是不会产生错误的状况的。
MTU:1500
1 2 3 4 5 6 7 8 9
$ ip link show eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 02:8a:2d:87:02:8e brd ff:ff:ff:ff:ff:ff
$ sudo ip link set dev eth0 mtu 1500
$ ip link show eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 02:8a:2d:87:02:8e brd ff:ff:ff:ff:ff:ff
