Mentat

Nenalezen zadny zaznam:

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Proto" : {"$ne": "qotd"}}, {"Source.Proto" : {"$ne": "ssdp"}}, {"Source.Port" : {"$ne": 123}}, {"Source.Proto" : {"$ne": "ntp"}}, {"Source.Proto" : {"$ne": "domain"}}, {"Source.Proto" : {"$ne": "netbios-ns"}}, {"Source.Port" : {"$ne": 623}}, {"Description": {"$ne": "Scan IPMI"}}, {"Source.Proto" : {"$ne": "chargen"}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_*__+++_Scan_SNMP': 2644,

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Description" : "Proxy_server"}]}

!!! Vulnerable 'Vulnerable_+++_External_+++_Proxy_+++_Proxy_server': 7

---

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}]}

Name Vulnerable Count >= 3066

---

FILTER: {"$and": [{"Category" : "Abusive.Spam"}, {"Node.Type" : {"$eq" : "External"}}, {"Node.Type" : {"$eq": "Data"}}, {"Node.Type" : {"$eq": "Policy"}}, {"Node.SW" : {"$eq" : "UCEPROT"}}]}

!!! 'Abusive.Spam_+++_Data:External:Policy_+++_*__+++_Backscatter_Report': 30,

LABEL_CZ: Host provozuje nesprávně nakonfigurovaný poštovní server (backscatter)

LABEL_EN: Host contains misconfigured mail server (backscatter)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Proto" : {"$eq": "qotd"}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_*__+++_Scan_QOTD': 317,

Name Vulnerable Count >= 56

LABEL_CZ: Host provozuje nesprávně nakonfigurovanou službu (QOTD)

LABEL_EN: Host contains misconfigured service (QOTD)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Proto" : {"$eq": "ssdp"}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_*__+++_Scan_SSDP': 4505,

Name Vulnerable Count >= 555

LABEL_CZ: Host provozuje nesprávně nakonfigurovanou službu (SSDP)

LABEL_EN: Host contains misconfigured service (SSDP)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"$or": [{"Source.Port" : {"$eq": 123}}, {"Source.Proto" : {"$eq": "ntp"}}]}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_*__+++_Scan_NTP': 5876,

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_*__+++_Scan_NTPMONITOR': 89,

Name Vulnerable Count >= 1414

LABEL_CZ: Host provozuje nesprávně nakonfigurovanou službu (NTP)

LABEL_EN: Host contains misconfigured service (NTP)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

U sserv-016 bych doplnil k protokolu NTP

    'Source': [   { 

                      'Port': [123],

                      'Proto': ['udp']}],

    '_CESNET': {   'EventTemplate': 'sserv-016',

---

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Proto" : {"$eq": "domain"}}, {"Source.Type" : {"$eq": "Backscatter"}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External_+++_*__+++_Open_DNS_Resolver': 19,

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_Backscatter_+++_Open_DNS_Resolver': 805,

Name Vulnerable Count >= 175

LABEL_CZ: Host provozuje otevřený DNS resolver

LABEL_EN: Host contains Open DNS Resolver

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

Proto: Domain, Source.Type: Backscatter?

    'ID': '1-1476412311.069296-BWdlraQwegG0',

    'Node': [   {'Name': 'cz.cesnet.au1.warden_filer', 'Type': ['Relay']},

                {   'Name': 'cz.cesnet.ext.x2',

                    'SW': ['X2'],

                    'Type': ['External']}],

    'Source': [   {   'IP4': [   {   'ip': b'\x93\xfb\x1b\xfe',

                                     'max': b'\x93\xfb\x1b\xfe',

                                     'min': b'\x93\xfb\x1b\xfe'}],

                      'Proto': ['udp', 'dns']}],

    '_CESNET': {   'EventTemplate': 'x2-004',

                   'Impact': 'System 147.251.27.254 is ORR and can be '

                             'misused to DDoS attacks',

                   'ResolvedAbuses': ['abuse@muni.cz'],

                   'StorageTime': 1476413642},

    '_id': '1-1476412311.069296-BWdlraQwegG0',

---

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Proto" : {"$eq": "netbios-ns"}}, {"Source.Type" : {"$eq": "Backscatter"}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_Backscatter_+++_Scan_NETBIOS': 12713,

Name Vulnerable Count >= 544

LABEL_CZ: Host provozuje nesprávně nakonfigurovanou službu (NETBIOS)

LABEL_EN: Host contains misconfigured service (NETBIOS)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

Chybi "Source.Proto": ipmi 

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Port" : {"$eq": 623}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_*__+++_Scan_IPMI': 2660,

Name Vulnerable Count >= 291

LABEL_CZ: Host provozuje nesprávně nakonfigurovanou službu (IPMI)

LABEL_EN: Host contains misconfigured service (IPMI)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services

'Description': 'Scan IPMI',

Neznamy port a chybi "Source.Proto": ipmi 

    'Category': ['Vulnerable.Config'],

    'CreateTime': b'\xdb\xa0\xa8 \x00\x00\x00\x00',

    'Description': 'Scan IPMI',

    'DetectTime': b'\xdb\x9e\xc5\xa1\x00\x00\x00\x00',

    'Format': 'IDEA0',

    'ID': '1-1475750304.823518-clDvseUpKMaG',

    'Node': [   {'Name': 'cz.cesnet.au1.warden_filer', 'Type': ['Relay']},

                {   'Name': 'cesnet.au1',

                    'SW': ['SSERV'],

                    'Type': ['External', 'Recon']}],

    'Source': [   {   'IP4': [   {   'ip': b'\x9e\xc2\xa0\t',

                                     'max': b'\x9e\xc2\xa0\t',

                                     'min': b'\x9e\xc2\xa0\t'}],

                      'Port': [2296]}],

    '_CESNET': {   'EventTemplate': 'sserv-017',

                   'Impact': 'System provides open Intelligent Platform '

                             'Management Interface service',

                   'ResolvedAbuses': ['abuse@upol.cz'],

                   'StorageTime': 1475750387},

    '_id': '1-1475750304.823518-clDvseUpKMaG',

"filter": {"$and": [{"DetectTime" : {"$gte" : "{gte}"}}, {"DetectTime" : {"$lte" : "{lte}"}}, {"Category" : "Vulnerable.Config"}, {"Source.Proto" : {"$eq": "chargen"}}, {"Source.Type" : {"$eq": "Backscatter"}}]}

!!! Vulnerable 'Vulnerable.Config_+++_External:Recon_+++_Backscatter_+++_Scan_CHARGEN': 46,

Name Vulnerable Count >= 10

LABEL_CZ: Host provozuje nesprávně nakonfigurovanou službu (CHARGEN)

LABEL_EN: Host contains misconfigured service (CHARGEN)

SEVERITY: 1 

URL: https://csirt.cesnet.cz/cs/services