Commit Graph

4 Commits (debc1a6334bdd9f37ccd043b6e3fe57b9c549d5d)

Author SHA1 Message Date
Mats Klepsland 1fea52dd8a detect: add keyword tls_cert_valid
Add keyword to check if TLS certificate is valid.
9 years ago
Mats Klepsland f22c9d9781 detect: add keyword tls_cert_expired
Add keyword to check if TLS certificate is expired.
9 years ago
Mats Klepsland 07d2312d96 detect-tls-validity: use flags for modes
Use flags for modes to support using multiple modes at the same time.
9 years ago
Mats Klepsland ea5696812f detect: add tls_cert_notbefore and tls_cert_notafter keywords
Detection plugin for TLS certificate fields notBefore and notAfter.

Supports equal to, less than, greater than, and range operations
for both keywords. Dates can be represented as either ISO 8601 or
epoch (Unix time).

Examples:
alert tls [...] tls_cert_notafter:1445852105; [...]
alert tls [...] tls_cert_notbefore:<2015-10-22T23:59:59; [...]
alert tls [...] tls_cert_notbefore:>2015-10-22; [...]
alert tls [...] tls_cert_notafter:2000-10-22<>2020-05-15; [...]
9 years ago