sethhall / credit-card-exposure

Detect credit card exposures with Bro

Credit Card Exposure

Detect credit card numbers in HTTP and SMTP with Zeek. This script only works with Zeek 3.0+.

Installation

Zeek Package Manager

zkg refresh
zkg install sethhall/credit-card-exposure

Alternate Manual Installation

cd <prefix>/share/zeek/site/
git clone git://github.com/sethhall/credit-card-exposure.git
echo "@load credit-card-exposure/scripts/" >> local.zeek

After the credit-card-exposure module is loaded, follow the configuration examples below.

Configuration

The only interesting configuration available for users is for log redaction. The default is conservative to avoid creating more sensitive data so notices and logs are redacted by default. If you would like to change this setting, you can add the following line to your local site configuration script after loading the module:

redef CreditCardExposure::redact_log = F;

credit-card-exposure's Issues

orphaned field "identity" in record coercion

after a record coercion fix in Bro (see http://tracker.bro.org/bro/ticket/936), this policy fails "broctl check" with the following error :

error in /usr/local/bro/share/bro/site/credit-card-exposure/./main.bro, lines 108-111: orphaned field "identity" in record coercion ....

followed by a lengthy error message.