Corelight_Zeek_ModelingRule_fix3

Packs/CorelightZeek/ModelingRules/CorelightZeek/CorelightZeek.xif

@@ -14,7 +14,7 @@ filter _path ~= "dns"
     xdm.event.id = uid,
     xdm.network.ip_protocol = if(proto=lowercase("HOPOPT"),XDM_CONST.IP_PROTOCOL_HOPOPT, proto=lowercase("ICMP"),XDM_CONST.IP_PROTOCOL_ICMP, proto=lowercase("IGMP"),XDM_CONST.IP_PROTOCOL_IGMP, proto=lowercase("GGP"),XDM_CONST.IP_PROTOCOL_GGP, proto=lowercase("IP"),XDM_CONST.IP_PROTOCOL_IP, proto=lowercase("ST"),XDM_CONST.IP_PROTOCOL_ST, proto=lowercase("TCP"),XDM_CONST.IP_PROTOCOL_TCP, proto=lowercase("CBT"),XDM_CONST.IP_PROTOCOL_CBT, proto=lowercase("EGP"),XDM_CONST.IP_PROTOCOL_EGP, proto=lowercase("IGP"),XDM_CONST.IP_PROTOCOL_IGP, proto=lowercase("BBN_RCC_MON"),XDM_CONST.IP_PROTOCOL_BBN_RCC_MON, proto=lowercase("NVP_II"),XDM_CONST.IP_PROTOCOL_NVP_II, proto=lowercase("PUP"),XDM_CONST.IP_PROTOCOL_PUP, proto=lowercase("ARGUS"),XDM_CONST.IP_PROTOCOL_ARGUS, proto=lowercase("EMCON"),XDM_CONST.IP_PROTOCOL_EMCON, proto=lowercase("XNET"),XDM_CONST.IP_PROTOCOL_XNET, proto=lowercase("CHAOS"),XDM_CONST.IP_PROTOCOL_CHAOS, proto=lowercase("UDP"),XDM_CONST.IP_PROTOCOL_UDP, proto=lowercase("MUX"),XDM_CONST.IP_PROTOCOL_MUX, proto=lowercase("DCN_MEAS"),XDM_CONST.IP_PROTOCOL_DCN_MEAS, proto=lowercase("HMP"),XDM_CONST.IP_PROTOCOL_HMP, proto=lowercase("PRM"),XDM_CONST.IP_PROTOCOL_PRM, proto=lowercase("XNS_IDP"),XDM_CONST.IP_PROTOCOL_XNS_IDP, proto=lowercase("TRUNK_1"),XDM_CONST.IP_PROTOCOL_TRUNK_1, proto=lowercase("TRUNK_2"),XDM_CONST.IP_PROTOCOL_TRUNK_2, proto=lowercase("LEAF_1"),XDM_CONST.IP_PROTOCOL_LEAF_1, proto=lowercase("LEAF_2"),XDM_CONST.IP_PROTOCOL_LEAF_2, proto=lowercase("RDP"),XDM_CONST.IP_PROTOCOL_RDP, proto=lowercase("IRTP"),XDM_CONST.IP_PROTOCOL_IRTP, proto=lowercase("ISO_TP4"),XDM_CONST.IP_PROTOCOL_ISO_TP4, proto=lowercase("NETBLT"),XDM_CONST.IP_PROTOCOL_NETBLT, proto=lowercase("MFE_NSP"),XDM_CONST.IP_PROTOCOL_MFE_NSP, proto=lowercase("MERIT_INP"),XDM_CONST.IP_PROTOCOL_MERIT_INP, proto=lowercase("DCCP"),XDM_CONST.IP_PROTOCOL_DCCP, proto=lowercase("3PC"),XDM_CONST.IP_PROTOCOL_3PC, proto=lowercase("IDPR"),XDM_CONST.IP_PROTOCOL_IDPR, proto=lowercase("XTP"),XDM_CONST.IP_PROTOCOL_XTP, proto=lowercase("DDP"),XDM_CONST.IP_PROTOCOL_DDP, proto=lowercase("IDPR_CMTP"),XDM_CONST.IP_PROTOCOL_IDPR_CMTP, proto=lowercase("TP"),XDM_CONST.IP_PROTOCOL_TP, proto=lowercase("IL"),XDM_CONST.IP_PROTOCOL_IL, proto=lowercase("IPV6"),XDM_CONST.IP_PROTOCOL_IPV6, proto=lowercase("SDRP"),XDM_CONST.IP_PROTOCOL_SDRP, proto=lowercase("IPV6_ROUTE"),XDM_CONST.IP_PROTOCOL_IPV6_ROUTE, proto=lowercase("IPV6_FRAG"),XDM_CONST.IP_PROTOCOL_IPV6_FRAG, proto=lowercase("IDRP"),XDM_CONST.IP_PROTOCOL_IDRP, proto=lowercase("RSVP"),XDM_CONST.IP_PROTOCOL_RSVP, proto=lowercase("GRE"),XDM_CONST.IP_PROTOCOL_GRE, proto=lowercase("DSR"),XDM_CONST.IP_PROTOCOL_DSR, proto=lowercase("BNA"),XDM_CONST.IP_PROTOCOL_BNA, proto=lowercase("ESP"),XDM_CONST.IP_PROTOCOL_ESP, proto=lowercase("AH"),XDM_CONST.IP_PROTOCOL_AH, proto=lowercase("I_NLSP"),XDM_CONST.IP_PROTOCOL_I_NLSP, proto=lowercase("SWIPE"),XDM_CONST.IP_PROTOCOL_SWIPE, proto=lowercase("NARP"),XDM_CONST.IP_PROTOCOL_NARP, proto=lowercase("MOBILE"),XDM_CONST.IP_PROTOCOL_MOBILE, proto=lowercase("TLSP"),XDM_CONST.IP_PROTOCOL_TLSP, proto=lowercase("SKIP"),XDM_CONST.IP_PROTOCOL_SKIP, proto=lowercase("IPV6_ICMP"),XDM_CONST.IP_PROTOCOL_IPV6_ICMP, proto=lowercase("IPV6_NONXT"),XDM_CONST.IP_PROTOCOL_IPV6_NONXT, proto=lowercase("IPV6_OPTS"),XDM_CONST.IP_PROTOCOL_IPV6_OPTS, proto=lowercase("CFTP"),XDM_CONST.IP_PROTOCOL_CFTP, proto=lowercase("SAT_EXPAK"),XDM_CONST.IP_PROTOCOL_SAT_EXPAK, proto=lowercase("KRYPTOLAN"),XDM_CONST.IP_PROTOCOL_KRYPTOLAN, proto=lowercase("RVD"),XDM_CONST.IP_PROTOCOL_RVD, proto=lowercase("IPPC"),XDM_CONST.IP_PROTOCOL_IPPC, proto=lowercase("SAT_MON"),XDM_CONST.IP_PROTOCOL_SAT_MON, proto=lowercase("VISA"),XDM_CONST.IP_PROTOCOL_VISA, proto=lowercase("IPCV"),XDM_CONST.IP_PROTOCOL_IPCV, proto=lowercase("CPNX"),XDM_CONST.IP_PROTOCOL_CPNX, proto=lowercase("CPHB"),XDM_CONST.IP_PROTOCOL_CPHB, proto=lowercase("WSN"),XDM_CONST.IP_PROTOCOL_WSN, proto=lowercase("PVP"),XDM_CONST.IP_PROTOCOL_PVP, proto=lowercase("BR_SAT_MON"),XDM_CONST.IP_PROTOCOL_BR_SAT_MON, proto=lowercase("SUN_ND"),XDM_CONST.IP_PROTOCOL_SUN_ND, proto=lowercase("WB_MON"),XDM_CONST.IP_PROTOCOL_WB_MON, proto=lowercase("WB_EXPAK"),XDM_CONST.IP_PROTOCOL_WB_EXPAK, proto=lowercase("ISO_IP"),XDM_CONST.IP_PROTOCOL_ISO_IP, proto=lowercase("VMTP"),XDM_CONST.IP_PROTOCOL_VMTP, proto=lowercase("SECURE_VMTP"),XDM_CONST.IP_PROTOCOL_SECURE_VMTP, proto=lowercase("VINES"),XDM_CONST.IP_PROTOCOL_VINES, proto=lowercase("TTP"),XDM_CONST.IP_PROTOCOL_TTP, proto=lowercase("NSFNET_IGP"),XDM_CONST.IP_PROTOCOL_NSFNET_IGP, proto=lowercase("DGP"),XDM_CONST.IP_PROTOCOL_DGP, proto=lowercase("TCF"),XDM_CONST.IP_PROTOCOL_TCF, proto=lowercase("EIGRP"),XDM_CONST.IP_PROTOCOL_EIGRP, proto=lowercase("OSPFIGP"),XDM_CONST.IP_PROTOCOL_OSPFIGP, proto=lowercase("SPRITE_RPC"),XDM_CONST.IP_PROTOCOL_SPRITE_RPC, proto=lowercase("LARP"),XDM_CONST.IP_PROTOCOL_LARP, proto=lowercase("MTP"),XDM_CONST.IP_PROTOCOL_MTP, proto=lowercase("AX25"),XDM_CONST.IP_PROTOCOL_AX25, proto=lowercase("IPIP"),XDM_CONST.IP_PROTOCOL_IPIP, proto=lowercase("MICP"),XDM_CONST.IP_PROTOCOL_MICP, proto=lowercase("SCC_SP"),XDM_CONST.IP_PROTOCOL_SCC_SP, proto=lowercase("ETHERIP"),XDM_CONST.IP_PROTOCOL_ETHERIP, proto=lowercase("ENCAP"),XDM_CONST.IP_PROTOCOL_ENCAP, proto=lowercase("GMTP"),XDM_CONST.IP_PROTOCOL_GMTP, proto=lowercase("IFMP"),XDM_CONST.IP_PROTOCOL_IFMP, proto=lowercase("PNNI"),XDM_CONST.IP_PROTOCOL_PNNI, proto=lowercase("PIM"),XDM_CONST.IP_PROTOCOL_PIM, proto=lowercase("ARIS"),XDM_CONST.IP_PROTOCOL_ARIS, proto=lowercase("SCPS"),XDM_CONST.IP_PROTOCOL_SCPS, proto=lowercase("QNX"),XDM_CONST.IP_PROTOCOL_QNX, proto=lowercase("AN"),XDM_CONST.IP_PROTOCOL_AN, proto=lowercase("IPCOMP"),XDM_CONST.IP_PROTOCOL_IPCOMP, proto=lowercase("COMPAQ_PEER"),XDM_CONST.IP_PROTOCOL_COMPAQ_PEER, proto=lowercase("IPX_IN_IP"),XDM_CONST.IP_PROTOCOL_IPX_IN_IP, proto=lowercase("VRRP"),XDM_CONST.IP_PROTOCOL_VRRP, proto=lowercase("PGM"),XDM_CONST.IP_PROTOCOL_PGM, proto=lowercase("L2TP"),XDM_CONST.IP_PROTOCOL_L2TP, proto=lowercase("DDX"),XDM_CONST.IP_PROTOCOL_DDX, proto=lowercase("IATP"),XDM_CONST.IP_PROTOCOL_IATP, proto=lowercase("STP"),XDM_CONST.IP_PROTOCOL_STP, proto=lowercase("SRP"),XDM_CONST.IP_PROTOCOL_SRP, proto=lowercase("UTI"),XDM_CONST.IP_PROTOCOL_UTI, proto=lowercase("SMP"),XDM_CONST.IP_PROTOCOL_SMP, proto=lowercase("SM"),XDM_CONST.IP_PROTOCOL_SM, proto=lowercase("PTP"),XDM_CONST.IP_PROTOCOL_PTP, proto=lowercase("ISIS"),XDM_CONST.IP_PROTOCOL_ISIS, proto=lowercase("FIRE"),XDM_CONST.IP_PROTOCOL_FIRE, proto=lowercase("CRTP"),XDM_CONST.IP_PROTOCOL_CRTP, proto=lowercase("CRUDP"),XDM_CONST.IP_PROTOCOL_CRUDP, proto=lowercase("SSCOPMCE"),XDM_CONST.IP_PROTOCOL_SSCOPMCE, proto=lowercase("IPLT"),XDM_CONST.IP_PROTOCOL_IPLT, proto=lowercase("SPS"),XDM_CONST.IP_PROTOCOL_SPS, proto=lowercase("PIPE"),XDM_CONST.IP_PROTOCOL_PIPE, proto=lowercase("SCTP"),XDM_CONST.IP_PROTOCOL_SCTP, proto=lowercase("FC"),XDM_CONST.IP_PROTOCOL_FC, proto=lowercase("RSVP_E2E_IGNORE"),XDM_CONST.IP_PROTOCOL_RSVP_E2E_IGNORE, proto=lowercase("MOBILITY"),XDM_CONST.IP_PROTOCOL_MOBILITY, proto=lowercase("UDPLITE"),XDM_CONST.IP_PROTOCOL_UDPLITE, proto=lowercase("MPLS_IN_IP"),XDM_CONST.IP_PROTOCOL_MPLS_IN_IP,to_string(proto)), 
     xdm.event.duration = to_integer(rtt),
-    xdm.network.dns.is_response = to_boolean(if(rejected ~= "T", "TRUE", "FALSE")),
+    xdm.network.dns.is_response = to_boolean(rejected),
     xdm.network.dns.dns_question.name = query,
     xdm.network.dns.dns_question.type = if(qtype_name="A",XDM_CONST.DNS_RECORD_TYPE_A, qtype_name="AAAA",XDM_CONST.DNS_RECORD_TYPE_AAAA, qtype_name="AFSDB",XDM_CONST.DNS_RECORD_TYPE_AFSDB, qtype_name="APL",XDM_CONST.DNS_RECORD_TYPE_APL, qtype_name="CAA",XDM_CONST.DNS_RECORD_TYPE_CAA, qtype_name="CDNSKEY",XDM_CONST.DNS_RECORD_TYPE_CDNSKEY, qtype_name="CDS",XDM_CONST.DNS_RECORD_TYPE_CDS, qtype_name="CERT",XDM_CONST.DNS_RECORD_TYPE_CERT, qtype_name="CNAME",XDM_CONST.DNS_RECORD_TYPE_CNAME, qtype_name="CSYNC",XDM_CONST.DNS_RECORD_TYPE_CSYNC, qtype_name="DHCID",XDM_CONST.DNS_RECORD_TYPE_DHCID, qtype_name="DLV",XDM_CONST.DNS_RECORD_TYPE_DLV, qtype_name="DNAME",XDM_CONST.DNS_RECORD_TYPE_DNAME, qtype_name="DNSKEY",XDM_CONST.DNS_RECORD_TYPE_DNSKEY, qtype_name="DS",XDM_CONST.DNS_RECORD_TYPE_DS, qtype_name="EUI48",XDM_CONST.DNS_RECORD_TYPE_EUI48, qtype_name="EUI64",XDM_CONST.DNS_RECORD_TYPE_EUI64, qtype_name="HINFO",XDM_CONST.DNS_RECORD_TYPE_HINFO, qtype_name="HIP",XDM_CONST.DNS_RECORD_TYPE_HIP, qtype_name="HTTPS",XDM_CONST.DNS_RECORD_TYPE_HTTPS, qtype_name="IPSECKEY",XDM_CONST.DNS_RECORD_TYPE_IPSECKEY, qtype_name="KEY",XDM_CONST.DNS_RECORD_TYPE_KEY, qtype_name="KX",XDM_CONST.DNS_RECORD_TYPE_KX, qtype_name="LOC",XDM_CONST.DNS_RECORD_TYPE_LOC, qtype_name="MX",XDM_CONST.DNS_RECORD_TYPE_MX, qtype_name="NAPTR",XDM_CONST.DNS_RECORD_TYPE_NAPTR, qtype_name="NS",XDM_CONST.DNS_RECORD_TYPE_NS, qtype_name="NSEC",XDM_CONST.DNS_RECORD_TYPE_NSEC, qtype_name="NSEC3",XDM_CONST.DNS_RECORD_TYPE_NSEC3, qtype_name="NSEC3PARAM",XDM_CONST.DNS_RECORD_TYPE_NSEC3PARAM, qtype_name="OPENPGPKEY",XDM_CONST.DNS_RECORD_TYPE_OPENPGPKEY, qtype_name="PTR",XDM_CONST.DNS_RECORD_TYPE_PTR, qtype_name="RRSIG",XDM_CONST.DNS_RECORD_TYPE_RRSIG, qtype_name="RP",XDM_CONST.DNS_RECORD_TYPE_RP, qtype_name="SIG",XDM_CONST.DNS_RECORD_TYPE_SIG, qtype_name="SMIMEA",XDM_CONST.DNS_RECORD_TYPE_SMIMEA, qtype_name="SOA",XDM_CONST.DNS_RECORD_TYPE_SOA, qtype_name="SRV",XDM_CONST.DNS_RECORD_TYPE_SRV, qtype_name="SSHFP",XDM_CONST.DNS_RECORD_TYPE_SSHFP, qtype_name="SVCB",XDM_CONST.DNS_RECORD_TYPE_SVCB, qtype_name="TA",XDM_CONST.DNS_RECORD_TYPE_TA, qtype_name="TKEY",XDM_CONST.DNS_RECORD_TYPE_TKEY, qtype_name="TLSA",XDM_CONST.DNS_RECORD_TYPE_TLSA, qtype_name="TSIG",XDM_CONST.DNS_RECORD_TYPE_TSIG, qtype_name="TXT",XDM_CONST.DNS_RECORD_TYPE_TXT, qtype_name="URI",XDM_CONST.DNS_RECORD_TYPE_URI, qtype_name="ZONEMD",XDM_CONST.DNS_RECORD_TYPE_ZONEMD, to_string(qtype_name)),
     xdm.network.dns.dns_resource_record.name = rcode,

Packs/CorelightZeek/ReleaseNotes/1_0_3.md

@@ -3,4 +3,4 @@
 
 ##### Corelight Zeek Modeling Rules
 
-- Updated the Modeling Rule schema for 'rejected' field
+- Updated the Modeling Rule schema for the rejected field

Packs/CorelightZeek/ReleaseNotes/1_0_4.md

@@ -0,0 +1,6 @@
+
+#### Modeling Rules
+
+##### Corelight Zeek Modeling Rules
+
+- Updated Modeling Rule logic.

Packs/CorelightZeek/pack_metadata.json

@@ -2,7 +2,7 @@
     "name": "Corelight Zeek",
     "description": "An open-source software network analysis framework.",
     "support": "xsoar",
-    "currentVersion": "1.0.3",
+    "currentVersion": "1.0.4",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",