search

cisagov / ICSNPP

Industrial Control Systems Network Protocol Parsers
BSD 3-Clause "New" or "Revised" License
153 stars 26 forks source link

Please don't ask users to overwrite Zeek base scripts #1

Closed sethhall closed 3 years ago

sethhall commented 3 years ago

Currently, your modbus and dnp3 scripts both recommend that users overwrite the scripts that are shipping with Zeek. It would be much better for everyone if you just treated these as completely separate scripts. You could have an option to do something like disable the existing built in logs.

One side benefit you get if you don't tell people to overwrite the existing scripts is that you can submit your scripts to the Zeek package manager and get more users through that.

We would be totally happy to discuss how to make the DNP3 and Modbus base scripts in Zeek better too! They haven't been extensively refined and it would be great to get some practitioners advice on what should be in those logs.

Thanks!

Kleinspider commented 3 years ago

Thanks! We have added a warning to the installation instructions for these two scripts and are currently developing a different installation process to not interfere with default Zeek files.

We are happy to discuss updates to the base DNP3 and Modbus scripts and would love to help improve them any way we can!

Kleinspider commented 3 years ago

The parsers and scripts have been modified to be extension scripts and no longer impact the original DNP3 and Modbus files.