-
Notifications
You must be signed in to change notification settings - Fork 58
Expand file tree
/
Copy pathdefault_config.hjson
More file actions
133 lines (129 loc) · 6.9 KB
/
default_config.hjson
File metadata and controls
133 lines (129 loc) · 6.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
{
"update_check_enabled": true,
"threat_intel": {
// Configuration for custom threat intel feeds
// Allowed format for the contents of both online feeds and custom file feeds is one IP or domain per line
// Online feeds must be valid URLs
"online_feeds": [
"https://feodotracker.abuse.ch/downloads/ipblocklist.txt"
]
},
"filtering": {
# These are filters that affect the import of connection logs. They
# currently do not apply to dns logs.
# A good reference for networks you may wish to consider is RFC 5735.
# https://tools.ietf.org/html/rfc5735#section-4
// internal_subnets identifies the internal network, which will result
// in any internal to internal and external to external connections being
// filtered out at import time. Reasonable defaults are provided below,
// but need to be manually verified before enabling.
"internal_subnets": [
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16",
"fd00::/8"
], # Private-Use Networks RFC 1918 and ULA prefix
// always_included_subnets overrides the never_included_* and internal_subnets section,
// making sure that any connection records containing addresses from these arrays are kept and not filtered
// Note: the IP address of a proxy must be included here if the proxy is internal
"always_included_subnets": [
], // array of CIDRs
"always_included_domains": [
], // array of FQDNs
// connections involving ranges entered into never_included_subnets are filtered out at import time
"never_included_subnets": [
], // array of CIDRs
"never_included_domains": [
], // array of FQDNs
"filter_external_to_internal": true // ignores any entries where communication is occurring from an external host to an internal host
},
"scoring": {
"beacon": {
// The default minimum number of unique connections used for beacons analysis.
// Any two hosts connecting fewer than this number will not be analyzed. You can
// safely increase this value to improve performance if you are not concerned
// about slow beacons.
"unique_connection_threshold": 4, // min number of unique connections to qualify as beacon
// The score is currently comprised of a weighted average of 4 subscores.
// While we recommend the default setting of 0.25 for each weight,
// these weights can be altered here according to your needs.
// The sum of all the floating point weights must be equal to 1.
"timestamp_score_weight": 0.25,
"datasize_score_weight": 0.25,
"duration_score_weight": 0.25,
"histogram_score_weight": 0.25,
// The number of hours seen in a connection graph representation of a beacon must
// be greater than this threshold for an overall duration score to be calculated.
// Default value: 6
"duration_min_hours_seen": 6,
// This is the minimum number of hours seen in a connection graph representation
// of a beacon for the consistency subscore of duration to score at 100%
// Default value: 12 (half the day)
"duration_consistency_ideal_hours_seen": 12,
// The histogram score has a subscore that attempts to detect multiple
// flat sections in a connection graph representation of a beacon. The
// variable below controls the bucket size for grouping connections.
// This is expressed as a percentage of the largest connection count. For example,
// if the max connection count is 400 and this variable is set to 0.05 (5%),
// the bucket size will be 20 (400*0.05=20). As you make this variable
// larger, the algorithm becomes more forgiving to variation.
// Default value 0.05
"histogram_mode_sensitivity": 0.05,
// This is the number of buckets that can be considered outliers and dropped
// from the calculation.
// Default value: 1
"histogram_bimodal_outlier_removal": 1,
// This is the minimum number of hours seen in a connection graph representation
// of a beacon before the bimodal subscore score is used.
// Default value: 11 (sets the minimum coverage to just below half of the day)
"histogram_bimodal_min_hours_seen": 11,
"score_thresholds": {
// beacon score
"base": 50,
"low": 70,
"medium": 90,
"high": 100
}
},
"long_connection_score_thresholds": {
// duration, in seconds
"base": 3600, // 1 hour
"low": 14400, // 4 hours
"medium": 28800, // 8 hours
"high": 43200 // 12 hours
},
"c2_score_thresholds": {
// number of subdomains
"base": 100,
"low": 500,
"medium": 800,
"high": 1000
},
"strobe_impact": {
"category": "high" // any strobes will be placed in the high category
},
"threat_intel_impact": {
"category": "high" // any threat intel hits will be placed in the high category
}
},
"modifiers": {
"threat_intel_score_increase": 0.15, // score +15% if data size >= 25 MB
"threat_intel_datasize_threshold": 25000000, // 25MB (as bytes)
"prevalence_score_increase": 0.15, // score +15% if prevalence <= 2%
"prevalence_increase_threshold": 0.02,
"prevalence_score_decrease": 0.15, // score -15% if prevalence >= 50%
"prevalence_decrease_threshold": 0.5, // must be greater than the increase threshold
// first seen scoring only applies to rolling datasets
// ** a dataset should be imported as rolling only if the logs are current (within the past 24 hours) i.e: coming from a live zeek sensor **
"first_seen_score_increase": 0.15, // score +15% if first seen <= 7 days ago
"first_seen_increase_threshold": 7,
"first_seen_score_decrease": 0.15, // score -15% if first seen >= 30 days ago
"first_seen_decrease_threshold": 30, // must be greater than the increase threshold
"missing_host_count_score_increase": 0.1, // +10% score for missing host header
"rare_signature_score_increase": 0.15, // +15% score for connections with a rare signature
"c2_over_dns_direct_conn_score_increase": 0.15, // +15% score for domains that were queried but had no direct connections
"mime_type_mismatch_score_increase": 0.15 // +15% score for connections with mismatched MIME type/URI
},
"months_to_keep_historical_first_seen": 3,
"batch_size": 100000
}