Notices raised:

Usage, notes and recommendations:

• This package can include a sample of the Server's response in the notice. This is to assist incident responders triage the detection. If you wish to have the server response artifacts included in your notice.log, change this option in scripts/main.zeek from the default F to T like so:
  const include_exploited_server_response_in_notice: bool = T;

• By default this package detects on all TCP ports, not just the default port 7001/tcp. To change the behavior to only detect on the specified port, use these options in scripts/main.zeek:
  const detect_default_port_only: bool = T;
const default_port: port = 7001/tcp;

• By default this package detects ALL exploit attempts - successful and unsuccessful. To change the behavior to only detect successful exploits, use these options in scripts/main.zeek:
  const detect_unsuccessful_attempts: bool = F;

• If you have scanners that you wish to exclude from detection, add them to the scripts/scanner_exclude_from_detection.zeek file.

• To run against a pcap you already have zeek -Cr your.pcap scripts/__load__.zeek

• This package will run in clustered or non clustered environments.

Feedback

• As details emerge, we are keen to improve this package for the benefit of the community, please feel free to contact the author with any suggestions and feedback.