Skip to content
Snippets Groups Projects
Commit 28c5d9d2 authored by Pavel Kácha's avatar Pavel Kácha
Browse files

LaBrea: Remove cruft template definition

parent 9e5be6d2
No related branches found
No related tags found
No related merge requests found
...@@ -283,21 +283,18 @@ class IdeaGen(object): ...@@ -283,21 +283,18 @@ class IdeaGen(object):
"connect": { "connect": {
"category": ["Recon.Scanning"], "category": ["Recon.Scanning"],
"description": "TCP connections/scan", "description": "TCP connections/scan",
"template": "labrea-001",
"note": "Connections from remote host to never assigned IP", "note": "Connections from remote host to never assigned IP",
"proto": ["tcp"] "proto": ["tcp"]
}, },
"ping": { "ping": {
"category": ["Recon.Scanning"], "category": ["Recon.Scanning"],
"description": "Ping scan", "description": "Ping scan",
"template": "labrea-002",
"note": "Ping requests from remote host to never assigned IP", "note": "Ping requests from remote host to never assigned IP",
"proto": ["icmp"] "proto": ["icmp"]
}, },
"synack": { "synack": {
"category": ["Availability.DoS"], "category": ["Availability.DoS"],
"description": "Unsolicited TCP SYN/ACK connections/scan", "description": "Unsolicited TCP SYN/ACK connections/scan",
"template": "labrea-003",
"note": "Unsolicited SYN/ACK packet received from remote host to never assigned IP", "note": "Unsolicited SYN/ACK packet received from remote host to never assigned IP",
"source_type": ["Backscatter"], "source_type": ["Backscatter"],
"source_to_target": True, "source_to_target": True,
...@@ -348,9 +345,6 @@ class IdeaGen(object): ...@@ -348,9 +345,6 @@ class IdeaGen(object):
"CeaseTime": self.format_timestamp(cease_time), "CeaseTime": self.format_timestamp(cease_time),
"ConnCount": count, "ConnCount": count,
"Note": tmpl["note"], "Note": tmpl["note"],
"_CESNET": {
"EventTemplate": tmpl["template"],
},
"Target": itargets, "Target": itargets,
"Node": [inode] "Node": [inode]
} }
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment