That was an awesome demo! Now let's pivot the conversation over to
the notice framework and what we can do for this.
You can think of the notice framework as how you can get
notified of certain events happening.
It defines an actual action to take once an event occurs.
So we have the following actions that are defined in the notice
framework that we're able to manipulate into notifying us of
those events that we want to know about.
We can use the action_log to write the notice into the logging stream, and by
default, this goes into the notice.log file. We can have it raise an alarm
and have the notice go into an hourly alarm log.
This action also emails the contents to the email addresses or the addresses
defined in the destination variables that we can set. The action_email allows
us to just send the email to the addresses listed.
You also have the ability to send to a pager email using the action_page
action. In order for us to take advantage of the notice framework, we
need to create a notice policy and a hook.
These can be used to customize the things that we
want the framework to accomplish.
We can also use the notice framework to filter out or use what's called
shortcuts to apply the common actions to the notices. When we're creating
scripts for use with the notice framework,
we need to make sure that we're defining everything that we want.
Of course,
the book of Zeek has detailed information on all of the
variables and field values that we can use.
Be sure to check this out so you can understand the options available to you.
We can use fields like the message and connection IDs and sources for the
information within the message, to name a few. We can even suppress certain
fields and messages to decrease the verboseness of a message or eliminate
receiving all notice messages for each event.
What I really like about the notice framework is that we can use the
policy hooks to pull in extra information for our notices. So, we can
include extra information in the email body,
for example, depending on the alert,
including the payload of the data transfer that we track.
This is defined using the notice::info record. In the coming demo,
we're going to dive deeper into this and walk through a few
different scripts that utilize the notice framework.