And now let's hop back into the lab to demonstrate a
little bit about the notice framework.
We're going to just take a look at some of the simple
actions that we can take with it and make sure that we
understand the various components of it.
And so now that we're here in our demo,
I want to take this time to make sure that we look at the Zeek notice index
first before we dive into a couple of the notice scripts.
So here we have all of the different functions that are available
for the notice framework that Zeek has built in,
so we can use it to detect things like brute force FTP attacks
or notifications for the Heartbleed attack,
things like that.
So,
as you can see, some of these protocols have more
functions in the notice framework than others.
But if you remember in the earlier module where we
were talking about signatures,
we actually used the notice framework as well because we were
passing along signature detection capabilities,
and we were able to see the signatures in the notice framework as well.
So keep this in mind as you're trying to build your own use
cases for using the notice framework.
These are the functions that are built in that we can use,
and you can also create your own.
So hopping back into the actual Zeek box that we're using,
one of the scripts that I want to go ahead and look at is
going to be in the notice framework itself.
And so we're going to go to the base framework
directory for the notice framework.
And as you can see, there's a couple different scripts here.
There's the action definitions that we can go ahead and look at
if we wanted to as well for some of them.
So we have the email script, we have the paging script, adding geo‑data to it.
But what we want to look at here is going to be the
main script for the notice framework.
And so this defines a lot of the actual logging stream for
the notice framework and how it interacts with the system
and everything like that.
So we have our export up here and we'll be talking
about this in the coming module.
And then we have the default hooks for the stream that are
defined for the global environment here.
And then it just goes in and starts defining the different types,
so we have the different actions that are defined here and
the different sets that compose them, various options for them.
So here we have the default_suppression_interval as 1 hour.
We have the different record fields that we're going
to pass along for all of this.
So here we have the connection records and ICMP connections and the UIDSs
and timestamps and destinations and so on and so forth.
So this script is all of the definitions that make up the
notice framework and how Zeek uses it.
Looking into here and understanding what Zeek provides us will help us
understand what we can redefine or what we need to build in a new
script if we want additional capabilities.
Another script that I wanted to look at is actually in that actions folder.
And so let's look at the email one, for example.
As you can see, this is quite a small script,
but it hooks in the notice framework, redefines the action email,
so we have a couple if‑then statements in the actual hook,
and we have all the functions and options and everything that
make up this hook and define those parameters.
So we're talking about where we're sending the emails to and so on and so forth.
And so for this email action,
it uses the function Site::get_emails in order to identify the address or
addresses that we want to send the email action to.
So that can be defined and we can add the addresses inside
of that function to get them sent away.
All right,
the final one that I want to go ahead and look at is going to be the
detect‑traceroute script in the policy section of the Zeek environment.
And so we have our signature here, and then we have the main script for it.
So let's check that out and see what we have going on
with the notice framework here.
As you can see, we have redefinition of one of the functions for the type,
and so this one's going to show that hosts that are
running traceroute are detected.
We have a couple of global constants that we're defining here.
We're defining a global event as well.
And then we're creating log streams for the traceroute activity.
We're defining some local parameters, we're defining some
thresholds as well for the ICMP time exceeded, we're defining
where the log's going to be written to.
And then if you look at the notice right here,
we're showing that the notice framework is involved in this script specifically.
So we're going to get a notice with an alert in the message that says this
source seems to be running traceroute using these elements here,
which are going to be the protocol, the source, and so on and so forth.
So when we're talking about invoking the notice framework,
it's similar to invoking the logging framework,
but we're just going to use this notice in the capital letters and
then define the events and how we're going to handle it. And that's
pretty much it for the notice framework for the purposes of this
course. There's plenty of resources online to be able to explore
this more on your own, so feel free to go visit them and check them out.
And now we're finished with the notice framework and ready to move on.
In this module,
we not only learned about the capabilities of notifying our analysts and
administrators whenever there's a significant event,
but we also learned all about the logs and the logging framework.
You should have an idea of how to manipulate both of these to suit your needs.
In the next module we'll dive into the basic scripting options
and learn how to start building scripts.
Join me there.