# Scanning IP's
**URL:** https://community.zeek.org/t/scanning-ips/4012
**Category:** Zeek
**Created:** [February 14, 2016, 11:14am UTC](https://community.zeek.org/t/scanning-ips/4012 "2016-02-14T11:14:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)
#### Post date: [February 14, 2016, 11:14am UTC](https://community.zeek.org/t/scanning-ips/4012/1 "2016-02-14T11:14:25Z")
As with every infrastructure I am plagued with people scanning my external edge. I see little value in getting notices for scanning attempts and password guessing attempts but I do see value in running monthly reports and generating blocklists based on repeat offenders.
Is there a way to tell the notice framework to only create alarms (emails) if it sees scans of any kind (address, port, password guessing, etc) if they are from the IP’s in my $HOME\_NET defined in network.cfg?
Justification, If I
redef Notice::ignored\_types += {
SSH::Password\_Guessing,
Scan::Address\_Scan,
Scan::Port\_Scan,
HTTP::SQL\_Injection\_Attacker,
ShellShock::Scanner,
ScanUDP::Address\_Scan,
ScanUDP::Port\_Scan,
};
Then I get no logging of the events anywhere. Therefore I can’t run reports of offenders and build active blocklists or other intel gathering activities.
If I:
# Set rule to only email specific notice types:
redef Notice::emailed\_types += {
Weird::Activity,
Signatures::Sensitive\_Signature,
Signatures::Multiple\_Signatures,
Signatures::Multiple\_Sig\_Responders,
Signatures::Count\_Signature,
Intel::Notice,
TeamCymruMalwareHashRegistry::Match,
Traceroute::Detected,
FTP::Bruteforcing,
FTP::Site\_Exec\_Success,
HTTP::SQL\_Injection\_Victim,
SMTP::Blocklist\_Error\_Message,
SMTP::Blocklist\_Blocked\_Host,
SMTP::Suspicious\_Origination,
SSH::Login\_By\_Password\_Guesser,
SSH::Interesting\_Hostname\_Login,
};
Then I get flooded with email from any of the guessing activity (Side note: I find that the above logic doesn’t restrict email notices to just those listed in the defined email types above. I still get plenty of notices about events not listed in the list above). If the redef Notice::emailed\_types worked it would be a start but I’d still like to get emails about IP addresses in my internal net getting scanned by other IP’s in my internal net, that definitely an indicator of unwanted behavior.
Any assistance would be greatly appreciated. Just trying to tune things to a manageable level.
Thanks
Tim
---
### Author:  [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)
#### Post date: [February 14, 2016, 12:35pm UTC](https://community.zeek.org/t/scanning-ips/4012/2 "2016-02-14T12:35:44Z")
The thing to understand is that the ignored\_types and emailed\_types are just tables defined to make tweaking the base notice policy easier.
That default notice policy is:
hook Notice::policy(n: Notice::Info) &priority=10
{
if ( n$note in Notice::ignored\_types )
break;
if ( n$note in Notice::not\_suppressed\_types )
n$suppress\_for=0secs;
if ( n$note in Notice::alarmed\_types )
add n$actions[ACTION\_ALARM];
if ( n$note in Notice::emailed\_types )
add n$actions[ACTION\_EMAIL];
if ( n$note in Notice::type\_suppression\_intervals )
n$suppress\_for=Notice::type\_suppression\_intervals[n$note];
# Logging is a default action. It can be removed in a later hook if desired.
add n$actions[ACTION\_LOG];
}
As you can see, adding notice types to those tables just tweaks the behavior of the default Notice::policy hook. To do some of the things you want to do, you just need a hook like
hook Notice::policy(n: Notice::Info)
{
if (n$note == Scan::Port\_Scan && Site::is\_local\_addr(n$src))
add n$actions[Notice::ACTION\_EMAIL];
}
If that would get repetitive, you can create your own table like
const local\_emailed\_types: set[Notice::Type] = {} &redef;
and have the policy be
hook Notice::policy(n: Notice::Info)
{
if (n$note in local\_emailed\_types && Site::is\_local\_addr(n$src))
add n$actions[Notice::ACTION\_EMAIL];
}
---
### Author:  [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)
#### Post date: [February 14, 2016, 1:19pm UTC](https://community.zeek.org/t/scanning-ips/4012/3 "2016-02-14T13:19:06Z")
FANTASTIC!! Giving it a shot now
---
### Author:  [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)
#### Post date: [February 14, 2016, 1:42pm UTC](https://community.zeek.org/t/scanning-ips/4012/4 "2016-02-14T13:42:21Z")
Followup question:
If I set this will I still get the other notices emailed to me such as items from the intel framework that I have set meta.do\_notice and meta.if\_in. Or will I have to make another notice hook to still allow for those to send emails when observed.
Obviously I have some bro scripting classes to attend, but in the meanwhile I am just trying to hack this together.
Tim
---
### Author:  [@Tim\_Desrochers](https://community.zeek.org/u/Tim_Desrochers)
#### Post date: [March 18, 2016, 10:25am UTC](https://community.zeek.org/t/scanning-ips/4012/5 "2016-03-18T10:25:23Z")
Sorry to beat a dead horse here but I am having a few issues with setting the alert\_email\_types.
I set the following in my local.bro:
redef Notice::emailed\_types += {
Weird::Activity,
Signatures::Sensitive\_Signature,
Signatures::Multiple\_Signatures,
Signatures::Multiple\_Sig\_Responders,
Signatures::Count\_Signature,
Intel::Notice,
TeamCymruMalwareHashRegistry::Match,
Traceroute::Detected,
FTP::Bruteforcing,
FTP::Site\_Exec\_Success,
SMTP::Blocklist\_Error\_Message,
SMTP::Blocklist\_Blocked\_Host,
SMTP::Suspicious\_Origination,
SSH::Login\_By\_Password\_Guesser,
SSH::Interesting\_Hostname\_Login,
};
Now here I would expect to only get emails from the notice framework for the defined types. But in actuality I get email from other things as well such as SQL\_Injection, Weird\_Activity, etc. I want the notice framework to log all these action but I don’t want emails sent to me for them.
I am using the emailed types to send emails to a alert dashboard for analysts to looka t. I only want things to go there that require immediate action by the analyst, all other notices I want logged and they can view them when they do their hourly checks of the net.
Did I configure the email\_types incorrectly. The end of my local.bro files contains the following email types modifications I have made:
redef Notice::emailed\_types += {
Weird::Activity,
Signatures::Sensitive\_Signature,
Signatures::Multiple\_Signatures,
Signatures::Multiple\_Sig\_Responders,
Signatures::Count\_Signature,
Intel::Notice,
TeamCymruMalwareHashRegistry::Match,
Traceroute::Detected,
FTP::Bruteforcing,
FTP::Site\_Exec\_Success,
SMTP::Blocklist\_Error\_Message,
SMTP::Blocklist\_Blocked\_Host,
SMTP::Suspicious\_Origination,
SSH::Login\_By\_Password\_Guesser,
SSH::Interesting\_Hostname\_Login,
};
# Only receive Scan Notices if they are from local network.
const local\_emailed\_types: set[Notice::Type] = {
SSH::Password\_Guessing,
} &redef;
hook Notice::policy(n: Notice::Info)
{
if (n$note in local\_emailed\_types && Site::is\_local\_addr(n$src))
add n$actions[Notice::ACTION\_EMAIL];
}
Any help would be appreciated.
Thanks
---
### Author:  [@Jan](https://community.zeek.org/u/Jan)
#### Post date: [March 18, 2016, 11:36am UTC](https://community.zeek.org/t/scanning-ips/4012/6 "2016-03-18T11:36:06Z")
Hi,
> redef Notice::emailed\_types += {
Blind guess, try:
redef Notice::emailed\_types = {
Regards,
Jan
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/scanning-ips/4012/7 "2022-05-06T15:43:25Z")