policy/protocols/conn/known-services.zeek¶
-
Known
¶
This script logs and tracks active services. For this script, an active service is defined as an IP address and port of a server for which a TCP handshake (SYN+ACK) is observed, assumed to have been done in the past (started seeing packets mid-connection, but the server is actively sending data), or sent at least one UDP packet. If a protocol name is found/known for service, that will be logged, but services whose names can’t be determined are also still logged.
- Namespace
Known
- Imports
base/frameworks/cluster, base/utils/directions-and-hosts.zeek
Summary¶
Runtime Options¶
The timeout interval to use for operations against
|
|
The hosts whose services should be tracked and logged. |
|
Require UDP server to respond before considering it an “active service”. |
Redefinable Options¶
The expiry interval of new entries in |
|
The Broker topic name to use for |
|
Toggles between different implementations of this script. |
State Variables¶
Holds the set of all known services. |
|
|
Tracks the set of daily-detected services for preventing the logging of duplicates, but can also be inspected by other scripts for different purposes. |
Types¶
The record type which contains the column fields of the known-services log. |
Redefinitions¶
The known-services logging stream identifier. |
|
|
Events¶
Event that can be handled to access the |
Hooks¶
A default logging policy hook for the stream. |
Detailed Interface¶
Runtime Options¶
-
Known::service_store_timeout
¶ -
The timeout interval to use for operations against
Known::service_store
.
-
Known::service_tracking
¶ - Type
- Attributes
- Default
LOCAL_HOSTS
- Redefinition
from policy/tuning/track-all-assets.zeek
=
:ALL_HOSTS
The hosts whose services should be tracked and logged. See
Host
for possible choices.
Redefinable Options¶
-
Known::service_store_expiry
¶ -
The expiry interval of new entries in
Known::service_store
. This also changes the interval at which services get logged.
-
Known::service_store_name
¶ -
The Broker topic name to use for
Known::service_store
.
State Variables¶
-
Known::service_store
¶ - Type
- Default
{ name=<uninitialized> store=<uninitialized> master_node="" master=F backend=Broker::MEMORY options=[sqlite=[path=""], rocksdb=[path=""]] clone_resync_interval=10.0 secs clone_stale_interval=5.0 mins clone_mutation_buffer_interval=2.0 mins }
Holds the set of all known services. Keys in the store are
Known::AddrPortServTriplet
and their associated value is always the boolean value of “true”.
-
Known::services
¶ -
Tracks the set of daily-detected services for preventing the logging of duplicates, but can also be inspected by other scripts for different purposes.
In cluster operation, this table is uniformly distributed across proxy nodes.
This table is automatically populated and shouldn’t be directly modified.
Types¶
-
Known::ServicesInfo
¶ - Type
-
- ts:
time
&log
The time at which the service was detected.
- host:
addr
&log
The host address on which the service is running.
- port_num:
port
&log
The port number on which the service is running.
- port_proto:
transport_proto
&log
The transport-layer protocol which the service uses.
- service:
set
[string
]&log
A set of protocols that match the service’s connection payloads.
- ts:
The record type which contains the column fields of the known-services log.
Events¶
-
Known::log_known_services
¶ - Type
event
(rec:Known::ServicesInfo
)
Event that can be handled to access the
Known::ServicesInfo
record as it is sent on to the logging framework.