Add tons of new alerts and improve some old ones.

alerts/correlated_alerts_pyes.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+#
+# Contributors:
+# Michal Purzynski michal@mozilla.com
+
+from lib.alerttask import AlertTask
+import pyes
+
+class AlertCorrelatedIntelNotice(AlertTask):
+    def main(self):
+        # look for events in last 15 mins
+        date_timedelta = dict(minutes=15)
+        # Configure filters using pyes
+        must = [
+            pyes.TermFilter('_type', 'bro'),
+            pyes.TermFilter('eventsource', 'nsm'),
+            pyes.TermFilter('category', 'bronotice'),
+            pyes.ExistsFilter('details.sourceipaddress'),
+            pyes.QueryFilter(pyes.MatchQuery('details.note','CrowdStrike::Correlated_Alerts','phrase'))
+        ]
+        self.filtersManual(date_timedelta, must=must)
+
+        # Search events
+        self.searchEventsSimple()
+        self.walkEvents()
+
+    # Set alert properties
+    def onEvent(self, event):
+        category = 'correlatedalerts'
+        tags = ['nsm,bro,correlated']
+        severity = 'NOTICE'
+        hostname = event['_source']['hostname']
+
+        # the summary of the alert is the same as the event
+        summary = '{0} {1}'.format(hostname, event['_source']['summary'])
+
+        # Create the alert object based on these properties
+        return self.createAlertDict(summary, category, tags, [event], severity)
+

alerts/httperrors_pyes.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+#
+# Contributors:
+# Michal Purzynski michal@mozilla.com
+
+from lib.alerttask import AlertTask
+import pyes
+
+class AlertHTTPErrors(AlertTask):
+    def main(self):
+        # look for events in last 15 mins
+        date_timedelta = dict(minutes=15)
+        # Configure filters using pyes
+        must = [
+            pyes.TermFilter('_type', 'bro'),
+            pyes.TermFilter('eventsource', 'nsm'),
+            pyes.TermFilter('category', 'bronotice'),
+            pyes.ExistsFilter('details.sourceipaddress'),
+            pyes.QueryFilter(pyes.MatchQuery('details.note','MozillaHTTPErrors::Excessive_HTTP_Errors_Attacker','phrase')),
+        ]
+        self.filtersManual(date_timedelta, must=must)
+
+        # Search events
+        self.searchEventsSimple()
+        self.walkEvents()
+
+    # Set alert properties
+    def onEvent(self, event):
+        category = 'httperrors'
+        tags = ['http']
+        severity = 'NOTICE'
+        hostname = event['_source']['hostname']
+
+        # the summary of the alert is the same as the event
+        summary = '{0} {1}'.format(hostname, event['_source']['summary'])
+
+        # Create the alert object based on these properties
+        return self.createAlertDict(summary, category, tags, [event], severity)
+

alerts/multiple_intel_hits_pyes.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+#
+# Contributors:
+# Anthony Verez averez@mozilla.com
+# Jeff Bryner jbryner@mozilla.com
+# Michal Purzynski <mpurzynski@mozilla.com>
+
+from lib.alerttask import AlertTask
+import pyes
+
+class AlertMultipleIntelHits(AlertTask):
+    def main(self):
+        # look for events in last X mins
+        date_timedelta = dict(minutes=2)
+        # Configure filters using pyes
+        must = [
+            pyes.TermFilter('_type', 'bro'),
+            pyes.TermFilter('eventsource', 'nsm'),
+            pyes.TermFilter('category', 'brointel'),
+            pyes.ExistsFilter('seenindicator'),
+            pyes.QueryFilter(pyes.MatchQuery('hostname', 'sensor1 sensor2 sensor3', 'boolean'))
+        ]
+        self.filtersManual(date_timedelta, must=must)
+
+        # Search aggregations on field 'seenindicator', keep X samples of events at most
+        self.searchEventsAggreg('seenindicator', samplesLimit=10)
+        # alert when >= X matching events in an aggregation
+        self.walkAggregations(threshold=10)
+
+    # Set alert properties
+    def onAggreg(self, aggreg):
+        # aggreg['count']: number of items in the aggregation, ex: number of failed login attempts
+        # aggreg['value']: value of the aggregation field, ex: toto@example.com
+        # aggreg['events']: list of events in the aggregation
+        category = 'bro'
+        tags = ['nsm,bro,intel']
+        severity = 'NOTICE'
+        hostname = aggreg['events'][0]['_source']['hostname']
+
+        summary = '{0} {1} {2} on {3}'.format(aggreg['count'], hostname, ' Bro intel match for indicator:', aggreg['value'])
+        
+        summary += ' sample hosts that hit it: '
+        for e in aggreg['events'][:3]:
+            if 'details' in e['_source'].keys() \
+               and 'sourceipaddress' in e['_source']['details'].keys() \
+               and 'seenwhere' in e['_source']['details'].keys():
+                interestingaddres = ''
+                # someone talking to a bad guy, I want to know who
+                # someone resolving bad guy's domain name, I want to know who
+                # bad guy talking to someone, I want to know to whom
+                if 'Conn::IN_RESP' in e['_source']['details']['seenwhere'] \
+                    or 'HTTP::IN_HOST_HEADER' in e['_source']['details']['seenwhere'] \
+                    or 'DNS::IN_REQUEST' in e['_source']['details']['seenwhere']:
+                    interestingaddres = e['_source']['details']['sourceipaddress']
+                elif 'Conn::IN_ORIG' in e['_source']['details']['seenwhere'] \
+                    or 'HTTP::IN_X_CLUSTER_CLIENT_IP_HEADER' in e['_source']['details']['seenwhere'] \
+                    or 'HTTP::IN_X_FORWARDED_FOR_HEADER' in e['_source']['details']['seenwhere']:
+                    interestingaddres = e['_source']['details']['destinationipaddress']
+
+                summary += '{0} in {1} '.format(interestingaddres, e['_source']['details']['seenwhere'])
+
+        # Create the alert object based on these properties
+        return self.createAlertDict(summary, category, tags, aggreg['events'], severity)

alerts/sshbruteforce_bro_pyes.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+#
+# Contributors:
+# Michal Purzynski michal@mozilla.com
+
+from lib.alerttask import AlertTask
+import pyes
+
+class AlertSSHManyConns(AlertTask):
+    def main(self):
+        # look for events in last 15 mins
+        date_timedelta = dict(minutes=15)
+        # Configure filters using pyes
+        must = [
+            pyes.TermFilter('_type', 'bro'),
+            pyes.TermFilter('eventsource', 'nsm'),
+            pyes.TermFilter('category', 'bronotice'),
+            pyes.ExistsFilter('details.sourceipaddress'),
+            pyes.QueryFilter(pyes.MatchQuery('details.note','SSH::Password_Guessing','phrase')),
+        ]
+        self.filtersManual(date_timedelta, must=must)
+
+        # Search events
+        self.searchEventsSimple()
+        self.walkEvents()
+
+    # Set alert properties
+    def onEvent(self, event):
+        category = 'bruteforce'
+        tags = ['http']
+        severity = 'NOTICE'
+        hostname = event['_source']['hostname']
+
+        # the summary of the alert is the same as the event
+        summary = '{0} {1}'.format(hostname, event['_source']['summary'])
+
+        # Create the alert object based on these properties
+        return self.createAlertDict(summary, category, tags, [event], severity)
+

alerts/ssl_blacklist_hit_pyes.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2014 Mozilla Corporation
+#
+# Contributors:
+# Michal Purzynski michal@mozilla.com
+
+from lib.alerttask import AlertTask
+import pyes
+
+class AlertSSLBlacklistHit(AlertTask):
+    def main(self):
+        # look for events in last 15 mins
+        date_timedelta = dict(minutes=15)
+        # Configure filters using pyes
+        must = [
+            pyes.TermFilter('_type', 'bro'),
+            pyes.TermFilter('eventsource', 'nsm'),
+            pyes.TermFilter('category', 'brointel'),
+            pyes.TermFilter('details.sources', 'abuse.ch SSLBL'),
+            pyes.ExistsFilter('details.sourceipaddress')
+        ]
+        self.filtersManual(date_timedelta, must=must)
+
+        # Search events
+        self.searchEventsSimple()
+        self.walkEvents()
+
+    # Set alert properties
+    def onEvent(self, event):
+        category = 'correlatedalerts'
+        tags = ['nsm,bro,correlated']
+        severity = 'NOTICE'
+        hostname = event['_source']['hostname']
+
+        # the summary of the alert is the same as the event
+        summary = '{0} {1}'.format(hostname, event['_source']['summary'])
+
+        # Create the alert object based on these properties
+        return self.createAlertDict(summary, category, tags, [event], severity)
+