does not work with Zeek v5.0

Question

does not work with Zeek v5.0

mmguero opened this issue 2 years ago · 3 comments

Zeek v5.0.0 was recently released. Here are the errors/warnings I get when using this package with that release:

> zeek -NN local 2>&1 | grep -i bzar
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 126-130: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::orig_h, BZAR::w (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 137-141: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::resp_h, BZAR::w (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42: type clash (string and eventlog::ElfrClearELFW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42 and string: type mismatch (eventlog::ElfrClearELFW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: inconsistent type in set constructor (set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: type clash in assignment (BZAR::t1070_001_rpc_strings = set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62: type clash (string and svcctl::CreateServiceWOW64W)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62 and string: type mismatch (svcctl::CreateServiceWOW64W and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: inconsistent type in set constructor (set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: type clash in assignment (BZAR::t1569_002_rpc_strings = set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73: type clash (string and IWbemServices::ExecMethod)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73 and string: type mismatch (IWbemServices::ExecMethod and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: inconsistent type in set constructor (set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: type clash in assignment (BZAR::t1047_rpc_strings = set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash (string and atsvc::JobAdd)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80 and string: type mismatch (atsvc::JobAdd and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: inconsistent type in set constructor (set(atsvc::JobAdd))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash in assignment (BZAR::t1053_002_rpc_strings = set(atsvc::JobAdd))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86: type clash (string and ITaskSchedulerService::SchRpcRegisterTask)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86 and string: type mismatch (ITaskSchedulerService::SchRpcRegisterTask and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: inconsistent type in set constructor (set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: type clash in assignment (BZAR::t1053_005_rpc_strings = set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103: type clash (string and winreg::BaseInitiateSystemShutdown)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103 and string: type mismatch (winreg::BaseInitiateSystemShutdown and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: inconsistent type in set constructor (set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: type clash in assignment (BZAR::t1529_rpc_strings = set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125: type clash (string and ISecLogon::SeclCreateProcessWithLogonW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125 and string: type mismatch (ISecLogon::SeclCreateProcessWithLogonW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: inconsistent type in set constructor (set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: type clash in assignment (BZAR::t1547_004_rpc_strings = set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132: type clash (string and spoolss::RpcAddMonitor)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132 and string: type mismatch (spoolss::RpcAddMonitor and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: inconsistent type in set constructor (set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: type clash in assignment (BZAR::t1547_010_rpc_strings = set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159: type clash (string and srvsvc::NetrServerTransportEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159 and string: type mismatch (srvsvc::NetrServerTransportEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: inconsistent type in set constructor (set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: type clash in assignment (BZAR::t1016_rpc_strings = set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166: type clash (string and srvsvc::NetrServerGetInfo)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166 and string: type mismatch (srvsvc::NetrServerGetInfo and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: inconsistent type in set constructor (set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: type clash in assignment (BZAR::t1018_rpc_strings = set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174: type clash (string and lsarpc::LsarGetUserName)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174 and string: type mismatch (lsarpc::LsarGetUserName and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: inconsistent type in set constructor (set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: type clash in assignment (BZAR::t1033_rpc_strings = set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192: type clash (string and srvsvc::NetrConnectionEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192 and string: type mismatch (srvsvc::NetrConnectionEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: inconsistent type in set constructor (set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: type clash in assignment (BZAR::t1049_rpc_strings = set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199: type clash (string and lsarpc::LsarEnumerateAccountRights)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199 and string: type mismatch (lsarpc::LsarEnumerateAccountRights and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: type clash in assignment (BZAR::t1069_rpc_strings = set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216: type clash (string and lsarpc::LsarQueryInformationPolicy)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216 and string: type mismatch (lsarpc::LsarQueryInformationPolicy and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: inconsistent type in set constructor (set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: type clash in assignment (BZAR::t1082_rpc_strings = set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash (string and srvsvc::NetrFileEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227 and string: type mismatch (srvsvc::NetrFileEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: inconsistent type in set constructor (set(srvsvc::NetrFileEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash in assignment (BZAR::t1083_rpc_strings = set(srvsvc::NetrFileEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233: type clash (string and lsarpc::LsarEnumerateAccounts)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233 and string: type mismatch (lsarpc::LsarEnumerateAccounts and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: type clash in assignment (BZAR::t1087_rpc_strings = set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash (string and srvsvc::NetrRemoteTOD)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260 and string: type mismatch (srvsvc::NetrRemoteTOD and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: inconsistent type in set constructor (set(srvsvc::NetrRemoteTOD))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash in assignment (BZAR::t1124_rpc_strings = set(srvsvc::NetrRemoteTOD))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266: type clash (string and srvsvc::NetrShareEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266 and string: type mismatch (srvsvc::NetrShareEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: inconsistent type in set constructor (set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: type clash in assignment (BZAR::t1135_rpc_strings = set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))

Answer 1 · 2022-07-08T13:22:15.000Z

I've submitted a PR which should fix these issues.

Answer 2 · 2023-01-22T00:18:50.000Z

Bzar does not work with zeek 5.1.1. Please share a fix or which version Bzar is most compatible with.

zeekctl deploy
checking configurations ...
zeek scripts failed.
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 126-130: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::orig_h, BZAR::w (when ((BZAR::n1 = lookup_addr(BZAR::orig_h)) && (BZAR::n1 in BZAR::w$orig_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
warning in /opt/zeek/share/zeek/site/packages/./bzar/./main.zeek, lines 137-141: "when" statement referring to locals without an explicit [] capture is deprecated: BZAR::match, BZAR::resp_h, BZAR::w (when ((BZAR::n2 = lookup_addr(BZAR::resp_h)) && (BZAR::n2 in BZAR::w$resp_names)) { BZAR::match = T} timeout BZAR::whitelist_dns_timeout { BZAR::match = F})
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25: type clash (string and drsuapi::DRSReplicaSync)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 25 and string: type mismatch (drsuapi::DRSReplicaSync and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: inconsistent type in set constructor (set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 25-26: type clash in assignment (BZAR::t1003_006_rpc_strings = set(drsuapi::DRSReplicaSync, drsuapi::DRSGetNCChanges))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42: type clash (string and eventlog::ElfrClearELFW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 42 and string: type mismatch (eventlog::ElfrClearELFW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: inconsistent type in set constructor (set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 43-44: type clash in assignment (BZAR::t1070_001_rpc_strings = set(eventlog::ElfrClearELFW, eventlog::ElfrClearELFA, IEventService::EvtRpcClearLog))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62: type clash (string and svcctl::CreateServiceWOW64W)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 62 and string: type mismatch (svcctl::CreateServiceWOW64W and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: inconsistent type in set constructor (set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 66-67: type clash in assignment (BZAR::t1569_002_rpc_strings = set(svcctl::CreateServiceWOW64W, svcctl::CreateServiceWOW64A, svcctl::CreateServiceW, svcctl::CreateServiceA, svcctl::StartServiceW, svcctl::StartServiceA))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73: type clash (string and IWbemServices::ExecMethod)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 73 and string: type mismatch (IWbemServices::ExecMethod and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: inconsistent type in set constructor (set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 73-74: type clash in assignment (BZAR::t1047_rpc_strings = set(IWbemServices::ExecMethod, IWbemServices::ExecMethodAsync))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash (string and atsvc::JobAdd)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80 and string: type mismatch (atsvc::JobAdd and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: inconsistent type in set constructor (set(atsvc::JobAdd))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 80: type clash in assignment (BZAR::t1053_002_rpc_strings = set(atsvc::JobAdd))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86: type clash (string and ITaskSchedulerService::SchRpcRegisterTask)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 86 and string: type mismatch (ITaskSchedulerService::SchRpcRegisterTask and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: inconsistent type in set constructor (set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 87-88: type clash in assignment (BZAR::t1053_005_rpc_strings = set(ITaskSchedulerService::SchRpcRegisterTask, ITaskSchedulerService::SchRpcRun, ITaskSchedulerService::SchRpcEnableTask))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103: type clash (string and winreg::BaseInitiateSystemShutdown)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 103 and string: type mismatch (winreg::BaseInitiateSystemShutdown and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: inconsistent type in set constructor (set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 108-109: type clash in assignment (BZAR::t1529_rpc_strings = set(winreg::BaseInitiateSystemShutdown, winreg::BaseInitiateSystemShutdownEx, InitShutdown::BaseInitiateShutdown, InitShutdown::BaseInitiateShutdownEx, WindowsShutdown::WsdrInitiateShutdown, winstation_rpc::RpcWinStationShutdownSystem, samr::SamrShutdownSamServer))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125: type clash (string and ISecLogon::SeclCreateProcessWithLogonW)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 125 and string: type mismatch (ISecLogon::SeclCreateProcessWithLogonW and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: inconsistent type in set constructor (set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 125-126: type clash in assignment (BZAR::t1547_004_rpc_strings = set(ISecLogon::SeclCreateProcessWithLogonW, ISecLogon::SeclCreateProcessWithLogonExW))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132: type clash (string and spoolss::RpcAddMonitor)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 132 and string: type mismatch (spoolss::RpcAddMonitor and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: inconsistent type in set constructor (set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 134-135: type clash in assignment (BZAR::t1547_010_rpc_strings = set(spoolss::RpcAddMonitor, spoolss::RpcAddPrintProcessor, IRemoteWinspool::RpcAsyncAddMonitor, IRemoteWinspool::RpcAsyncAddPrintProcessor))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159: type clash (string and srvsvc::NetrServerTransportEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 159 and string: type mismatch (srvsvc::NetrServerTransportEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: inconsistent type in set constructor (set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 159-160: type clash in assignment (BZAR::t1016_rpc_strings = set(srvsvc::NetrServerTransportEnum, wkssvc::NetrWkstaTransportEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166: type clash (string and srvsvc::NetrServerGetInfo)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 166 and string: type mismatch (srvsvc::NetrServerGetInfo and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: inconsistent type in set constructor (set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 167-168: type clash in assignment (BZAR::t1018_rpc_strings = set(srvsvc::NetrServerGetInfo, srvsvc::NetrServerAliasEnum, wkssvc::NetrWkstaGetInfo))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174: type clash (string and lsarpc::LsarGetUserName)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 174 and string: type mismatch (lsarpc::LsarGetUserName and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: inconsistent type in set constructor (set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 185-186: type clash in assignment (BZAR::t1033_rpc_strings = set(lsarpc::LsarGetUserName, lsarpc::LsarEnumerateTrustedDomainsEx, lsarpc::LsarGetSystemAccessAccount, lsarpc::LsarQueryDomainInformationPolicy, lsarpc::LsarQueryInfoTrustedDomain, samr::SamrEnumerateGroupsInDomain, samr::SamrEnumerateDomainsInSamServer, samr::SamrQueryInformationDomain, samr::SamrQueryInformationDomain2, samr::SamrQueryInformationGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192: type clash (string and srvsvc::NetrConnectionEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 192 and string: type mismatch (srvsvc::NetrConnectionEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: inconsistent type in set constructor (set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 192-193: type clash in assignment (BZAR::t1049_rpc_strings = set(srvsvc::NetrConnectionEnum, srvsvc::NetrSessionEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199: type clash (string and lsarpc::LsarEnumerateAccountRights)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 199 and string: type mismatch (lsarpc::LsarEnumerateAccountRights and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 209-210: type clash in assignment (BZAR::t1069_rpc_strings = set(lsarpc::LsarEnumerateAccountRights, lsarpc::LsarEnumerateAccountsWithUserRight, lsarpc::LsarEnumeratePrivileges, lsarpc::LsarEnumeratePrivilegesAccount, lsarpc::LsarLookupPrivilegeValue, lsarpc::LsarLookupPrivilegeName, lsarpc::LsarLookupPrivilegeDisplayName, samr::SamrGetGroupsForUser, samr::SamrGetAliasMembership, samr::SamrGetMembersInAlias, samr::SamrGetMembersInGroup))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216: type clash (string and lsarpc::LsarQueryInformationPolicy)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 216 and string: type mismatch (lsarpc::LsarQueryInformationPolicy and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: inconsistent type in set constructor (set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 219-221: type clash in assignment (BZAR::t1082_rpc_strings = set(lsarpc::LsarQueryInformationPolicy, lsarpc::LsarQueryInformationPolicy2, lsarpc::LsarQueryTrustedDomainInfo, lsarpc::LsarQueryTrustedDomainInfoByName, samr::SamrGetUserDomainPasswordInformation))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash (string and srvsvc::NetrFileEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227 and string: type mismatch (srvsvc::NetrFileEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: inconsistent type in set constructor (set(srvsvc::NetrFileEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 227: type clash in assignment (BZAR::t1083_rpc_strings = set(srvsvc::NetrFileEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233: type clash (string and lsarpc::LsarEnumerateAccounts)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 233 and string: type mismatch (lsarpc::LsarEnumerateAccounts and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: inconsistent type in set constructor (set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 252-254: type clash in assignment (BZAR::t1087_rpc_strings = set(lsarpc::LsarEnumerateAccounts, lsarpc::LsarLookupNames, lsarpc::LsarLookupNames2, lsarpc::LsarLookupNames3, lsarpc::LsarLookupNames4, lsarpc::LsarLookupSids, lsarpc::LsarLookupSids2, lsarpc::LsarLookupSids3, samr::SamrEnumerateAliasesInDomain, samr::SamrEnumerateUsersInDomain, samr::SamrLookupNamesInDomain, samr::SamrLookupIdsInDomain, samr::SamrLookupDomainInSamServer, samr::SamrQueryDisplayInformation, samr::SamrQueryDisplayInformation2, samr::SamrQueryDisplayInformation3, samr::SamrQueryInformationAlias, samr::SamrQueryInformationUser, samr::SamrQueryInformationUser2, wkssvc::NetrWkstaUserEnum))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash (string and srvsvc::NetrRemoteTOD)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260 and string: type mismatch (srvsvc::NetrRemoteTOD and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: inconsistent type in set constructor (set(srvsvc::NetrRemoteTOD))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 260: type clash in assignment (BZAR::t1124_rpc_strings = set(srvsvc::NetrRemoteTOD))
error in string and /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266: type clash (string and srvsvc::NetrShareEnum)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, line 266 and string: type mismatch (srvsvc::NetrShareEnum and string)
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: inconsistent type in set constructor (set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))
error in /opt/zeek/share/zeek/site/packages/./bzar/./bzar_dce-rpc_consts.zeek, lines 266-267: type clash in assignment (BZAR::t1135_rpc_strings = set(srvsvc::NetrShareEnum, srvsvc::NetrShareGetInfo))

Answer 3 · 2023-10-02T17:16:02.000Z

Fixed with #16