The following TQL queries are Bro Notice queries. Zeek (formerly Bro) calls the NOTICE function when it detects suspicious activity leaving the network.
Identify evidence of SQL injection, port scans, invalid certs, etc.
Note
Result categories may include
ssl:invalid_server_cert, traceroute::detected, proto, scan::port_scan, scan::address_scan, http::sql_injection_attacker, enum, weird::activity, packetfilter::dropped_packets, http::sql_injection_victim, andssh::password_guessing
class:bro_notice | groupby category
Identify HTTP traffic which is not traversing the proxy as expected
class:bro_http !metaclass:http_proxy
Identify evidence of SQL injection and port scans
class:bro_notice !srcisp:["private ip address lan","<target corporation name>"] action:notice::action_log | groupby dstport
Identify sources of port scanning grouped by source IP address and destination port
class:bro_notice category:scan::address_scan !srcisp:"private ip address lan" !srcisp:"<target corporation>" | groupby [srcipv4,dstport]
Identify invalid SSL server certificate validation
class:bro_notice !srcisp:"private ip address lan" !srcisp:"<target corporation>" action:notice::action_log dstisp:"private ip address lan" category:ssl::invalid_server_cert | groupby [srcipv4,dstipv4]
Identify possible SQL injection grouped by source IP address
class:bro_notice category:http::sql_injection_attacker !srcisp:"private ip address lan" !srcisp:"<target corporation>" | groupby srcipv4
Identify possible SQL injection grouped by destination IP address
class:bro_notice category:http::sql_injection_victim dstisp:"private ip address lan" | groupby dstipv4