A powerful, easily deployable network traffic analysis tool suite for network security monitoring
As Zeek logs are parsed and enriched prior to indexing, a severity score up to 100
(a higher score indicating a more severe event) can be assigned when one or more of the following conditions are met:
SENSITIVE_COUNTRY_CODES
environment variable in lookup-common.env
FREQ_SEVERITY_THRESHOLD
environment variable in lookup-common.env
. A lower value will only assign severity scores to fewer domain names with higher entropy (e.g., 2.0
for NQZHTFHRMYMTVBQJE.COM
), while a higher value will assign severity scores to more domain names with lower entropy (e.g., 7.5
for naturallanguagedomain.example.org
)notice.log
, intel.log
and weird.log
entries, including those generated by Zeek plugins detecting vulnerabilities (see the list of Zeek plugins under Components)TOTAL_MEGABYTES_SEVERITY_THRESHOLD
environment variable in lookup-common.env
CONNECTION_SECONDS_SEVERITY_THRESHOLD
environment variable in lookup-common.env
As this feature is improved, it is expected additional severity scoring categories will be identified and implemented.
When a Zeek log satisfies more than one of these conditions its severity scores will be summed, with a maximum score of 100
. A Zeek log’s severity score is indexed in the event.severity
field and the conditions that contributed to its score are indexed in event.severity_tags
.
The category severity scores can be customized by editing logstash/maps/malcolm_severity.yaml
:
1
and 100
for severity scoring.0
."PROTOCOL_XYZ"
, where XYZ
is the uppercased value of the protocol as stored in the network.protocol
field. For example, to assign a score of 40
to Zeek logs generated for SSH traffic, you could add the following line to malcolm_severity.yaml
:"PROTOCOL_SSH": 40
Restart Logstash after modifying malcolm_severity.yaml
for the changes to take effect.
Severity scoring can be disabled globally by setting the LOGSTASH_SEVERITY_SCORING
environment variable to false
in the logstash.env
file and restarting Malcolm.