Set your logs on fire with Emoji-ð¥
Emojifier is the ð¨ of choice to get a fast overview on your Zeek connection log. On top, it also serves as the perfect management summary of your network's security status. ð¹ð¡ï¸ð¢
It adds an additional column to your conn.log showing emojis that give you information about the connections in your log. The following emojis are currently supported:
| Emoji | Meaning |
|---|---|
| ð | HTTP Traffic |
| ð | DNS Traffic |
| ð¨ | SMTP Traffic |
| âï¸ | SIP Traffic |
| 𥵠| Connection with many bytes |
| ð | Some bytes were missed |
| ð | TCP Connection was rejected |
| ð | Connection direction was flipped |
| ð¨ | There is a notice for this connection |
| 𥴠| Zeek deems this connection weird |
| ð¥ | There was an Intel hit |
Furthermore, there is an additional script to emojify default policies.
Add @load emojifier/emojify-policies to your local.zeek to enable the following additional emojis:
| Emoji | Meaning |
|---|---|
| â | Expired certificate |
| â³ | Certificate expires soon |
| ð | Old TLS version |
| ð | Heartbleed attack detected |
| ð | SQL injection detected |
| ð£ | Vulnerable software version |
| ð¤ | Login with guessed SSH password |
Usage ð
The scripts are available as package for the Zeek Package Manager and can be installed using the following command: zkg install emojifier
To set your logs on ð¥ make sure the package is loaded: zkg load emojifier
To enable the additional emojis including the corresponding policy scripts add @load emojifier/emojify-policies to your local.zeek.
Please note that emojification (utf8 support) is a Zeek-only feature. If you haven't already upgraded to Zeek, ð is the reason you should do it!
Fun with Flags ð©ðª ðºð¸ ð¯ð²
Of course, we have also added support for Zeek's GeoLocation framework. First you need to make sure that the framework is available (see Zeek Docs). For a quick test run a command like the following:
zeek -e "print lookup_location(8.8.8.8);"
If that works without any issues, you are ready to go. Just add @load emojifier/emojify-geo to your local.zeek.
Extending ð§
Want to put ð¥? No problem, the emojifier can be easily extended. Just add your custom logic by handling an event and concatenating the additional emoji to the emoji_trail string in the connection record. The following example adds the ð³ emoji.
event connection_state_remove(c: connection) &priority=5
{
if ( c?$tunnel )
c$emoji_trail += "ð³";
}
Note that you need to use a priority > 0 in case you are handling the connection_state_remove event.
If you want to extend the Emoji-ð¥ based on notices that is even easier. You just need to extend the Emojifier::custom_notices table:
redef custom_notices += {
[Notice::Tally] = "ð¤",
};
We are looking forward to merge your pull-request ð