And speaking of those events,
let's get them defined. So the first event that we need is
the initialization event, and this is going to be used to
create the log stream for us.
Notice how I have my module name here,
preceding the log statement. I'm tagging the information above in the
export column as where Zeek's going to pull the columns for for the
logs themselves, and the path is downloads.
So this is going to create a log called downloads.log
in the local folder that we're at.
And even just looking at this script so far,
we have a lot of different components that we've seen in this course so
far and a lot of different options that we have, so we're redefining
different functions and pieces of events.
We're redefining records. We're creating our own record type for
this local script and defining the different fields and the values
and data types that they're using.
We have constants here that we're defining to use later on as
part of the variables in the actual events.
So there's already quite a bit of different components that we've learned
about in this course, and we're using them here. So we'll close that bracket
and then move on to the next event, and this is going to be the event that
has all of the functionality that we want.
So, the event that we're going to use for this is going to be the
connection_state_remove, and this event is where Zeek finishes
tracking the connection and is ready to forget about it, so it's
asking us what to do, pretty much.
And here, I'm defining a local variable called megabyte,
or mb, and defining it as an integer.
And this statement right here is going to define
what constitutes this mb variable.
So, what it means is I'm defining mb equals the responding bytes
that Zeek sees from the connection record,
dividing it by the conversion, or the conv, that we
defined above in the constant section.
So it's going to take the bytes and divide it by
1,000,000 to make the megabytes.
And now with this if statement is defining is if we have the duration of the
connection is greater than the duration that we defined above in the constants
and the responding port in the connection ID from the connection record is
equal to the HTTP port that we defined above, so 80/tcp, and the responding
bytes is greater than the HTTP size that we defined, then we're going to take
these actions in this event section right here. And now what this line right
there is doing is it's defining all of the fields that we have passed from the
record above, and we're telling it what those equal, what they line up to.
So, the ID is going to be the connection ID.
The timestamp is going to be the network time. But where we're pulling in
information from the connection record besides the ID is the source IP
and the destination IP to protocol, so you see how we have the connection
ID and then the originating host or the responding host. And then for the
protocol, and the size, and all of that information, here, we're using
the connection record itself to see the responding bytes, and we're also
looking at the megabyte variable that we defined previously.
So, we're mapping the fields from the record above to what they
actually mean from the connection record itself.
And now the log write statement is going to be used to pass that
large log info and the local record that we just defined above it
into it and actually write to the log.
Now one more thing that we're going to do real quick
is do the notice framework as well.
So remember how we redefined that notice type into the
High_Traffic_Download? And so that's what we're calling right here
with a Large:High_Traffic_Download as the note itself.
So we're calling that function as the note. And then the message itself,
we're just going to have the notice framework say Large HTTP Transfer Detected.
This is an insecure port as well.
So, this is our script.
It's pretty simple.
We have one if statement here where we're defining our criteria and making
sure that it aligns with the parameters that we set in the constants, and
then we're defining our logs that we want to use, and then we're passing the
notice to the notice framework as well.