step_log : file
Alerts related to stepping-stone detection go in this file.
display_pairs : table[addr, string] of connection
If <conn> was a login to <dst> propagating a $DISPLAY of <display>, then we make an entry of [<dst>, <display>] = <conn>.
tag_to_conn_map : table[string] of connection
Maps login tags like "Last login ..." to connections.
conn_tag_info : table[conn_id] of tag_info
A table, indexed by connection ID, of thetag_info
related to it. Roughly, “tag info” consists of login strings like “Last login” and$DISPLAY
variables. Since this information can stay constant across stepping stones, it is used to detect them.
detected_stones : table[addr, port, addr, port, addr, port, addr, port] of count
Indexed by two pairs of connections: (addr,port)->(addr,port) and
(addr,port)->(addr,port) that have been detected to be multiple links
in a stepping stone chain. The table value is the “score” of the
pair of connections; the higher the score, the more likely it is to be
a real stepping stone pair. More points are assigned for a
timing-based correlation than, say, a $DISPLAY
-based correlation.
did_stone_summary : table[addr, port, addr, port, addr, port, addr, port] of count
Basically tracks which suspected stepping stone connection pairs have had alerts
generated for them. See detected_stones
for the indexing scheme.
stp_delta : interval
Note: This variable isconst
, so may only be changed viaredef
.
stp_idle_min : interval
Note: This variable isconst
, so may only be changed viaredef
.
stp_ratio_thresh : double
For timing correlations, the proportion of idle times that must match up for the correlation to be considered significant.
Note: This variable isconst
, so may only be changed viaredef
.
stp_scale : double
Note: This variable isconst
, so may only be changed viaredef
.
stp_common_host_thresh : count
Note: This variable isconst
, so may only be changed viaredef
.
stp_random_pair_thresh : count
Note: This variable isconst
, so may only be changed viaredef
.
stp_demux_disabled : count
Note: This variable isconst
, so may only be changed viaredef
.
skip_clear_ssh_reports : set[addr, string]
Note: This variable isconst
, so may only be changed viaredef
.