Zeek

Zeek's Intel framework watches every connection, DNS lookup and HTTP request for indicators you give it, and logs matches to intel.log. Feed it the blocklist as address indicators.

Set it up

1. Write the intel file hourly from cron. The format is tab-separated with a #fields header:

   {
     printf '#fields\tindicator\tindicator_type\tmeta.source\tmeta.desc\tmeta.url\n'
     curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=csv&confidenceMinimum=75&limit=200000" \
       | awk -F, 'NR>1 {printf "%s\tIntel::ADDR\tisipsafe\tconfidence %s, %s reports\thttps://isipsafe.com/ip/%s\n", $1, $2, $3, $1}'
   } > /opt/zeek/share/zeek/site/isipsafe.intel.new && mv /opt/zeek/share/zeek/site/isipsafe.intel.new /opt/zeek/share/zeek/site/isipsafe.intel

2. Load it in local.zeek:

   @load frameworks/intel/seen
   @load frameworks/intel/do_notice
   
   redef Intel::read_files += { "/opt/zeek/share/zeek/site/isipsafe.intel" };

   and deploy with zeekctl deploy. Zeek re-reads intel files when they change, so later downloads need no restart.

Matches appear in intel.log with the connection, where it was seen (Conn::IN_ORIG, Conn::IN_RESP) and the description and link from the file. Ship intel.log to your SIEM, or turn matches into notices with do_notice to alert on them.

Running Security Onion? It uses Zeek underneath; put the file in its intel directory and the matches show up in the Hunt interface.

Need a hand?

If something here does not work with your version of Zeek, or you have improved it, tell us. We update these pages with what people send.

Zeek and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.