Skip to content

[Rule Tuning] Add Zeek Index Support#6206

Open
eric-forte-elastic wants to merge 11 commits into
mainfrom
zeek_protocol_detection
Open

[Rule Tuning] Add Zeek Index Support#6206
eric-forte-elastic wants to merge 11 commits into
mainfrom
zeek_protocol_detection

Conversation

@eric-forte-elastic
Copy link
Copy Markdown
Contributor

@eric-forte-elastic eric-forte-elastic commented May 27, 2026 •
edited
Loading

Pull Request

Issue link(s):

Resolves #6029

Summary - What I changed

Small Update to include Zeek log sources for compatible network rules. Also updates our manifests and schemas to include the Zeek integration.

For more context on the testing and evaluation done for this change to be supported please see #5932

How To Test

For some rules, customers have already added Zeek data indexes so they can be verified in telemetry. Alternatively one can use the RTAs: elastic/cortado#34

If using RTAs for testing make sure that you are also using the Zeek integration (as the RTAs will also work with the other integrations). This can be verified on in the alert shown below.
image

For the two rules with query changes, here are the RTA run results (also can verify in telemetry)
image

Checklist

  • Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
  • Added the meta:rapid-merge label if planning to merge within 24 hours
  • Secret and sensitive material has been managed correctly
  • Automated testing was updated or added to match the most common scenarios
  • Documentation and comments were added for features that require explanation

Contributor checklist

@eric-forte-elastic eric-forte-elastic self-assigned this May 27, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 27, 2026

Enhancement - Guidelines

These guidelines serve as a reminder set of considerations when addressing adding a feature to the code.

Documentation and Context

  • Describe the feature enhancement in detail (alternative solutions, description of the solution, etc.) if not already documented in an issue.
  • Include additional context or screenshots.
  • Ensure the enhancement includes necessary updates to the documentation and versioning.

Code Standards and Practices

  • Code follows established design patterns within the repo and avoids duplication.
  • Ensure that the code is modular and reusable where applicable.

Testing

  • New unit tests have been added to cover the enhancement.
  • Existing unit tests have been updated to reflect the changes.
  • Provide evidence of testing and validating the enhancement (e.g., test logs, screenshots).
  • Validate that any rules affected by the enhancement are correctly updated.
  • Ensure that performance is not negatively impacted by the changes.
  • Verify that any release artifacts are properly generated and tested.
  • Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Checks

  • Verify that the enhancement works across all relevant environments (e.g., different OS versions).
  • Confirm that the proper version label is applied to the PR patch, minor, major.

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 27, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 27, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Inbound Connection to an Unsecure Elasticsearch Node (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Inbound Connection to an Unsecure Elasticsearch Node (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Inbound Connection to an Unsecure Elasticsearch Node (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Inbound Connection to an Unsecure Elasticsearch Node (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Inbound Connection to an Unsecure Elasticsearch Node (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@tradebot-elastic
Copy link
Copy Markdown

tradebot-elastic commented May 28, 2026 •
edited
Loading

⛔️ Test failed

Results
  • ❌ Abnormally Large DNS Response (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (lucene)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RPC (Remote Procedure Call) to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ RDP (Remote Desktop Protocol) from the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMB (Windows File Sharing) Activity to the Internet (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta
  • ❌ SMTP on Port 26/TCP (kuery)
    • coverage_issue: no_rta
    • stack_validation_failed: no_rta

@eric-forte-elastic eric-forte-elastic marked this pull request as ready for review May 28, 2026 23:39
terrancedejesus
terrancedejesus approved these changes May 29, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@Mikaayenson Mikaayenson Awaiting requested review from Mikaayenson Mikaayenson is a code owner

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@imays11 imays11 Awaiting requested review from imays11

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

At least 2 approving reviews are required to merge this pull request.

Assignees

@eric-forte-elastic eric-forte-elastic

Labels

backport: auto Domain: Network enhancement New feature or request integration: Zeek patch Rule: Tuning tweaking or tuning an existing rule

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[FR] Update Network Rules With Zeek Support

3 participants

@eric-forte-elastic @tradebot-elastic @terrancedejesus