Modifying TDS ports for Zeek in 2.4

[oneCrazyAdmin]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

96

RAM

256

Storage for /

250Gb

Storage for /nsm

41Tb

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Our SQL servers operate on a different port that the standard 1337. I would like to add an additional port number 5189. There was a custom script or custom setup instruction in the Read-The-Docs for version 2.3

How does one go about changing or adding a port number to the TDS script in zeek for Security Onion.

I have added the old link for the Zeek Custom scripts for reference Zeek Custom Scripts

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Use a policy script to do this. Place the script in /opt/so/saltstack/local/salt/zeek/policy/custom/filters. For example, mysql_ports.zeek

The script to place, if you are editing the MYSQL analyzer (change the ports to whatever you want to add):

const ports = { 12345/tcp, 12346/tcp };

event zeek_init() &priority=5
	{
	Analyzer::register_for_ports(Analyzer::ANALYZER_MYSQL, ports);
	}

Also, add you __load__.zeek file with @load ./mysql_ports.zeek

In SOC --> Administration --> Configuration --> zeek --> config --> local --> load add custom/filters/mysql_ports Then synchronize your grid.

https://docs.zeek.org/en/v6.0.9/scripts/base/frameworks/analyzer/main.zeek.html#id-Analyzer::register_for_ports

[oneCrazyAdmin]

that did it! Thanks! Here is what I ended up with.

`
const ports = { 1337/tcp, 5189/tcp };

event zeek_init() &priority=5
{
Analyzer::register_for_ports(Analyzer::ANALYZER_TDS, ports);
}

`
and I put it in a tds_ports.zeek file in the /opt/so/saltstack/local/salt/zeek/policy/custom/filters directory