Feature Request: Add known applications + risk score field based off destination.port fields
ryanpodonnell1 opened this issue · 2 comments
ryanpodonnell1 commented
User Story - details
As a SIEM engineer I want to know port numbers associated with the destination.port field. This will allow me to quickly identify potential applications communicating on the session and also the risk of the traffic Im observing
Tasks
- Create a port lookup translation.
- Add risk category score to application (scale of 1-10 or severity name).
Examples:
3389 -> Remote Desktop Protocol (high risk)
22 - Secure Shell (high risk)
3306 - MySQL (medium risk)
6881-6889 - Bit Torrent (high risk)
brian-grabau commented
We added this didn't we?
https://github.com/Cargill/OpenSIEM-Logstash-Parsing/blob/master/config/enrichments/96_lookup_iana_protocol.conf
I know you have another enrichment you wanted but this one is completed? Or is this the mapping to Palo Alto risk score
brian-grabau commented
Enrichment has been updated with Protocols and transport lookups