Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Running Security Onion.
- so16@so16:~$ lsb_release -a
- No LSB modules are available.
- Distributor ID: Ubuntu
- Description: Ubuntu 16.04.6 LTS
- Release: 16.04
- Codename: xenial
- EQL installed.
- so16@so16:~$ eql --version
- eql 0.6.2
- EQL works on sample data.
- so16@so16:~$ eql query -f example.json "process where process_name == 'explorer.exe'"
- {"command_line": "C:\\Windows\\Explorer.EXE", "event_subtype_full": "already_running", "event_type_full": "process_event", "md5": "ac4c51eb24aa95b77f705ab159189e24", "opcode": 3, "pid": 2460, "ppid": 3052, "process_name": "explorer.exe", "process_path": "C:\\Windows\\explorer.exe", "serial_event_id": 34, "timestamp": 131485997150000000, "unique_pid": 34, "unique_ppid": 0, "user_domain": "research", "user_name": "researcher"}
- Sample Zeek conn.log.
- so16@so16:~$ cat conn.log
- {"ts":"2019-03-14T23:59:49.920582Z","uid":"CPQ9vC2my8sIGasb3a","id.orig_h":"192.168.4.57","id.orig_p":42051,"id.resp_h":"192.168.4.1","id.resp_p":53,"proto":"udp","service":"dns","duration":0.000368,"orig_bytes":0,"resp_bytes":234,"conn_state":"SHR","local_orig":true,"local_resp":true,"missed_bytes":0,"history":"^d","orig_pkts":0,"orig_ip_bytes":0,"resp_pkts":2,"resp_ip_bytes":290,"sensorname":"so16-enp0s8"}
- {"ts":"2019-03-14T23:59:00.699642Z","uid":"CiEbJY1e6EoUiEaBW4","id.orig_h":"173.230.144.109","id.orig_p":123,"id.resp_h":"192.168.4.18","id.resp_p":57878,"proto":"udp","conn_state":"S0","local_orig":false,"local_resp":true,"missed_bytes":0,"history":"D","orig_pkts":1,"orig_ip_bytes":76,"resp_pkts":0,"resp_ip_bytes":0,"sensorname":"so16-enp0s8"}
- Plan to replace . with _
- so16@so16:~$ cat conn.log | sed 's/\./_/g'
- {"ts":"2019-03-14T23:59:49_920582Z","uid":"CPQ9vC2my8sIGasb3a","id_orig_h":"192_168_4_57","id_orig_p":42051,"id_resp_h":"192_168_4_1","id_resp_p":53,"proto":"udp","service":"dns","duration":0_000368,"orig_bytes":0,"resp_bytes":234,"conn_state":"SHR","local_orig":true,"local_resp":true,"missed_bytes":0,"history":"^d","orig_pkts":0,"orig_ip_bytes":0,"resp_pkts":2,"resp_ip_bytes":290,"sensorname":"so16-enp0s8"}
- {"ts":"2019-03-14T23:59:00_699642Z","uid":"CiEbJY1e6EoUiEaBW4","id_orig_h":"173_230_144_109","id_orig_p":123,"id_resp_h":"192_168_4_18","id_resp_p":57878,"proto":"udp","conn_state":"S0","local_orig":false,"local_resp":true,"missed_bytes":0,"history":"D","orig_pkts":1,"orig_ip_bytes":76,"resp_pkts":0,"resp_ip_bytes":0,"sensorname":"so16-enp0s8"}
- Create new file with no .
- so16@so16:~$ cat conn.log | sed 's/\./_/g' > conn.mod.json
- Show new file.
- so16@so16:~$ cat conn.mod.json
- {"ts":"2019-03-14T23:59:49_920582Z","uid":"CPQ9vC2my8sIGasb3a","id_orig_h":"192_168_4_57","id_orig_p":42051,"id_resp_h":"192_168_4_1","id_resp_p":53,"proto":"udp","service":"dns","duration":0_000368,"orig_bytes":0,"resp_bytes":234,"conn_state":"SHR","local_orig":true,"local_resp":true,"missed_bytes":0,"history":"^d","orig_pkts":0,"orig_ip_bytes":0,"resp_pkts":2,"resp_ip_bytes":290,"sensorname":"so16-enp0s8"}
- {"ts":"2019-03-14T23:59:00_699642Z","uid":"CiEbJY1e6EoUiEaBW4","id_orig_h":"173_230_144_109","id_orig_p":123,"id_resp_h":"192_168_4_18","id_resp_p":57878,"proto":"udp","conn_state":"S0","local_orig":false,"local_resp":true,"missed_bytes":0,"history":"D","orig_pkts":1,"orig_ip_bytes":76,"resp_pkts":0,"resp_ip_bytes":0,"sensorname":"so16-enp0s8"}
- Try query.
- so16@so16:~$ eql query -f conn.mod.json "any where id_orig_h == '192_168_4_57'"
- Traceback (most recent call last):
- File "/home/so16/.local/bin/eql", line 11, in <module>
- sys.exit(main())
- File "/home/so16/.local/lib/python2.7/site-packages/eql/main.py", line 90, in main
- parsed.func(parsed)
- File "/home/so16/.local/lib/python2.7/site-packages/eql/main.py", line 60, in query
- engine.stream_events(stream, finalize=False)
- File "/home/so16/.local/lib/python2.7/site-packages/eql/engines/native.py", line 1205, in stream_events
- for event in events:
- File "/home/so16/.local/lib/python2.7/site-packages/eql/utils.py", line 172, in stream_file_events
- for event in stream_events(handle, file_format=file_format):
- File "/home/so16/.local/lib/python2.7/site-packages/eql/utils.py", line 204, in stream_events
- return json.load(fileobj)
- File "/usr/lib/python2.7/json/__init__.py", line 291, in load
- **kw)
- File "/usr/lib/python2.7/json/__init__.py", line 339, in loads
- return _default_decoder.decode(s)
- File "/usr/lib/python2.7/json/decoder.py", line 364, in decode
- obj, end = self.raw_decode(s, idx=_w(s, 0).end())
- File "/usr/lib/python2.7/json/decoder.py", line 380, in raw_decode
- obj, end = self.scan_once(s, idx)
- ValueError: Expecting ',' delimiter: line 1 column 192 (char 191)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement