So this demo is going to span over the next few clips,
and we'll walk through the creation of the script step by step.
Then, once it's finished, we'll go and validate that it works as expected.
If you're ready, then let's hop in.
All right, and here we are in our local site directory. Again,
this is the director we have been working in for most of the course so far.
Real quick, I'm going to show the directory in here,
and we have our script created, but I'm going to go ahead and remove it.
That way, we can walk through it step by step.
So we're just going to nano it, and it brings us into a new workspace.
So the first part of the configuration that I'm going to copy,
paste into here is just the commented section telling me what the script does,
so it's going to detect large HTTP transfers inbound.
And oops!
We have it set up for HTTP right now, not HTTPS, so we'll fix that.
These first couple sections,
we're loading the notice framework because we're going to use that here.
We're loading the base/protocols/connection scripts since those connection
records and events from the connections are used in many different aspects
of the scripting within the Zeek environment.
I also loaded the HTTP protocol scripts,
even though we don't really need it and we're not using them in the
script. So we can actually go ahead and comment those out because we
don't need it at this moment, but what we could do later on is
expand upon our current script and look at HTTP‑specific parameters
inside the payload or, you know, other HTTP parameters that Zeek will generate.
And then finally,
we're using our module Large to create our own environment right now.
So this is the large environment, it's to detect the large HTTP transfers,
and we're going to use this as a tag in several other aspects of the scripting.
So then the next thing that we're going to go ahead and do is I want to
change the logging to make sure that it only uses JSON,
so this is the command to do that.
We've seen it previously in the course,
and so we're just going to make that true using a
redefinition for this function here.
Another way that we could have done this if we wanted to is just loaded
that tuning script that turns this on automatically.
And now it's time to define the export.
So this is the second section of the script that we're going to be working in.
So this first part, we're going to be redefining our logs,
and more specifically, will define a new record for them.
And here,
what we're doing is we're just defining all of the fields
that we want to include and pass down into the logging
framework from these events.
So as you can see, we're going through,
and we're defining all of the different fields that we want.
And now that that's done, we can talk about it for a second.
So we're defining all of these fields, the ts field,
the id field,
proto, src_ip, dst_ip, size, and size_in_mbps. And the middle column
here is we're defining what type of data they are, so the ts is time,
the protocol is transport protocol, the source and destination IPs
are our addresses, the size is a double. As we've mentioned
previously in the course,
this is where we can redefine the record for the logging
information that we're going to get from this.
Now, up next, we need to define a few constants, and now
that we've defined these constants, let's talk through them a little bit.
So we have the http_duration one, which I sat for 10 seconds.
This is the threshold that we're going to compare
the duration of the connection to.
We have the http_size, which is a double. This is the
size in bytes that we're going to compare the size that
the connection tracked as well.
The http_port constant is a definition that we wanted to use to compare
all of the rest of the traffic and only identify the http_port as part of
the event that we want. And then this conv,
the conversion, and what we wanted to do is convert the
traditional amount of bytes into megabytes instead of having to
convert it ourselves, and that clues me into another aspect of
my script that I have to fix.
This is actually megabytes, not megabits per second.
And so these constants are going to be used later on
inside of the actual event itself.
Another redefinition that I wanted to make is for the
notice type, and so this is going to redefine Notice::Type
as a notice High Traffic Download,
and we'll use that in the Notice framework later on in the module as well.
And that's it for the export section now. We'll be able to see all of this in
action a little bit later on when we're defining the events.