Index

_

__author__ (in module salo) __len__() (salo.outputs.Sessions method) (salo.salo.Session method) (salo.salo.Sessions method) (salo.Session method) (salo.Sessions method) __repr__() (salo.outputs.Sessions method) (salo.salo.Session method) (salo.salo.Sessions method) (salo.Session method) (salo.Sessions method) __version__ (in module salo) _load_model() (salo.Event method) (salo.salo.Event method) _refs (salo.events.suricata.dns.DNSModel attribute) (salo.events.suricata.DNSModel attribute) (salo.events.suricata.http.HTTPModel attribute) (salo.events.suricata.HTTPModel attribute) (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute)

_save() (salo.outputs.splunkhec.SplunkOutput method) _template (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.eventcode.EventCodeModel attribute) (salo.events.sysmon.windows.EventCode3Model attribute) (salo.events.sysmon.windows.EventCodeModel attribute)

A

Access (class in salo.events.github.audit.repo) ActionsEnabled (class in salo.events.github.audit.repo) ActorLocationModel (class in salo.events.github.audit.base) AddAdmin (class in salo.events.github.audit.business) AddMember (class in salo.events.github.audit.org) (class in salo.events.github.audit.team) AddOrganization (class in salo.events.github.audit.business) AdvancedSecurityEnabled (class in salo.events.github.audit.repo) allow_population_by_field_name (salo.events.SaloEventModel.Config attribute), [1] (salo.SaloEventModel.Config attribute) (salo.SaloStencilModel.Config attribute) (salo.stencils.SaloStencilModel.Config attribute), [1]

allow_reuse (salo.events.SaloEventModel.Config attribute), [1] (salo.SaloEventModel.Config attribute) (salo.SaloStencilModel.Config attribute) (salo.stencils.SaloStencilModel.Config attribute), [1] analyzers (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) app_proto (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute)

B

BusinessModel (class in salo.events.github.audit.business)

C

Cadence (class in salo.cadence) CancelInvitation (class in salo.events.github.audit.org) cert_chain_fps (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) cert_count (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) cert_permanent (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) cert_type (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) ChangeMergeSetting (class in salo.events.github.audit.repo) cipher (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_build (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) client_cert_chain_fps (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_channels (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) client_ciphers (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_comp_methods (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_curves (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_dig_product_id (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) client_issuer (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_key_share_groups (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_name (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) client_subject (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute)

client_supported_versions (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) client_version (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) Clone (class in salo.events.github.audit.git) CobaltStrikeDNSC2 (class in salo.stencils.cobaltstrike.dns) Computer (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) ConfigChanged (class in salo.events.github.audit.hook) ConfigModel (class in salo.events.github.audit.hook) conn_state (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) CONN_STATES (in module salo.events.zeek.conn) conn_uids (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) ConnModel (class in salo.events.zeek) (class in salo.events.zeek.conn) ConsoleOutput (class in salo.outputs.console) content_type (salo.events.github.audit.hook.ConfigModel attribute) ContentAnalysisDisable (class in salo.events.github.audit.repository) ContentAnalysisEnable (class in salo.events.github.audit.repository) cookie (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) country_code (salo.events.github.audit.base.ActorLocationModel attribute) Create (class in salo.events.github.audit.business) (class in salo.events.github.audit.hook) (class in salo.events.github.audit.integration) (class in salo.events.github.audit.org) (class in salo.events.github.audit.repo) (class in salo.events.github.audit.team) create_session() (salo.outputs.Sessions method) (salo.salo.Sessions method), [1] (salo.Sessions method) current() (salo.cadence.Cadence method) curve (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute)

D

DEFAULT_CADENCE (salo.cadence.Cadence attribute) DependencyGraphDisable (class in salo.events.github.audit.repository) DependencyGraphEnable (class in salo.events.github.audit.repository) depth (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) desktop_height (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) desktop_width (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) dest_ip (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) (salo.events.zeek.base.ZeekModel attribute) (salo.events.zeek.ZeekModel attribute) dest_port (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.dns.DNSModel attribute) (salo.events.suricata.DNSModel attribute) (salo.events.suricata.http.HTTPModel attribute) (salo.events.suricata.HTTPModel attribute) (salo.events.suricata.SuricataModel attribute) (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) (salo.events.zeek.base.ZeekModel attribute) (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) (salo.events.zeek.ZeekModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) DestinationHostname (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) DestinationIsIpv6 (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) DestinationPortName (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) Destroy (class in salo.events.github.audit.integration) (class in salo.events.github.audit.repo) dh_param_size (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) dns (salo.events.suricata.dns.DNSModel attribute) (salo.events.suricata.DNSModel attribute) dns_aa (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_addl (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_answers (salo.events.suricata.dns.DNSModelFull attribute) dns_auth (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_grouped (salo.events.suricata.dns.DNSModelFull attribute) dns_id (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_original_query (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_qa (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) dns_qclass (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_qclass_name (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_qr (salo.events.suricata.dns.DNSModelFull attribute)

dns_qtype (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) dns_qtype_name (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) dns_query (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) dns_ra (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) dns_rcode (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) dns_rcode_name (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) dns_rd (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) dns_rdata (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) dns_rejected (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_rtt (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_tc (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) dns_ttl (salo.events.suricata.dns.DNSModelFull attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) dns_type (salo.events.suricata.dns.DNSModelFull attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) dns_version (salo.events.suricata.dns.DNSModelFull attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) dns_z (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) DNSModel (class in salo.events.suricata) (class in salo.events.suricata.dns) (class in salo.events.zeek) (class in salo.events.zeek.dns) DNSModel.Config (class in salo.events.zeek) (class in salo.events.zeek.dns) DNSModelFull (class in salo.events.suricata.dns) DNSModelFull.Config (class in salo.events.suricata.dns) DOMAINS (in module salo.stencils.cobaltstrike.dns) duration (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute)

E

encryption_level (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) encryption_method (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) established (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) Event (class in salo) (class in salo.salo), [1] event_type (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.dns.DNSModel attribute) (salo.events.suricata.DNSModel attribute) (salo.events.suricata.http.HTTPModel attribute) (salo.events.suricata.HTTPModel attribute) (salo.events.suricata.SuricataModel attribute)

EventCode3Model (class in salo.events.sysmon.windows) (class in salo.events.sysmon.windows.eventcode) EventCodeModel (class in salo.events.sysmon.windows) (class in salo.events.sysmon.windows.eventcode) EventCodeModel.Config (class in salo.events.sysmon.windows) (class in salo.events.sysmon.windows.eventcode) EventRecordID (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) EventsChanged (class in salo.events.github.audit.hook) extract_size (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) extracted (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) extracted_cutoff (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute)

F

fake (in module salo) (in module salo.events.zeek) (in module salo.salo) Fetch (class in salo.events.github.audit.git) fields (salo.events.github.audit.base.GitHubAuditModel.Config attribute) (salo.events.suricata.dns.DNSModelFull.Config attribute) (salo.events.suricata.http.HTTPModelFull.Config attribute) (salo.events.sysmon.windows.eventcode.EventCodeModel.Config attribute) (salo.events.sysmon.windows.EventCodeModel.Config attribute) (salo.events.zeek.base.ZeekModel.Config attribute) (salo.events.zeek.dns.DNSModel.Config attribute) (salo.events.zeek.DNSModel.Config attribute) (salo.events.zeek.http.HTTPModel.Config attribute) (salo.events.zeek.HTTPModel.Config attribute) (salo.events.zeek.smtp.SMTPModel.Config attribute) (salo.events.zeek.SMTPModel.Config attribute) (salo.events.zeek.ZeekModel.Config attribute)

FilesModel (class in salo.events.zeek) (class in salo.events.zeek.files) flow_id (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) fuid (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) fuids (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute)

G

generate() (salo.events.github.audit.base.GitHubAuditModel method) (salo.events.suricata.base.SuricataModel method) (salo.events.suricata.SuricataModel method) (salo.events.sysmon.windows.eventcode.EventCodeModel method) (salo.events.sysmon.windows.EventCodeModel method) (salo.events.zeek.base.ZeekModel method) (salo.events.zeek.ZeekModel method) (salo.outputs.Sessions method) (salo.salo.Session method), [1] (salo.salo.Sessions method), [1] (salo.Session method) (salo.Sessions method) GenerateClientSecret (class in salo.events.github.audit.integration) get_options() (salo.events.suricata.dns.DNSModel method) (salo.events.suricata.DNSModel method) (salo.events.suricata.http.HTTPModel method) (salo.events.suricata.HTTPModel method) get_saved_value() (salo.Event method) (salo.salo.Event method), [1] github_action (salo.events.github.audit.business.AddAdmin attribute) (salo.events.github.audit.business.AddOrganization attribute) (salo.events.github.audit.business.Create attribute) (salo.events.github.audit.business.ImportLicenseUsage attribute) (salo.events.github.audit.business.InviteAdmin attribute) (salo.events.github.audit.git.Clone attribute) (salo.events.github.audit.git.Fetch attribute) (salo.events.github.audit.git.Push attribute) (salo.events.github.audit.hook.ConfigChanged attribute) (salo.events.github.audit.hook.Create attribute) (salo.events.github.audit.hook.EventsChanged attribute) (salo.events.github.audit.integration.Create attribute) (salo.events.github.audit.integration.Destroy attribute) (salo.events.github.audit.integration.GenerateClientSecret attribute) (salo.events.github.audit.integration.RemoveClientSecret attribute) (salo.events.github.audit.org.AddMember attribute) (salo.events.github.audit.org.CancelInvitation attribute) (salo.events.github.audit.org.Create attribute) (salo.events.github.audit.org.InviteMember attribute) (salo.events.github.audit.org.RemoveMember attribute) (salo.events.github.audit.org.RemoveOutsideCollaborator attribute) (salo.events.github.audit.org.RestoreMember attribute) (salo.events.github.audit.org.UpdateTermsOfService attribute) (salo.events.github.audit.repo.Access attribute) (salo.events.github.audit.repo.ActionsEnabled attribute) (salo.events.github.audit.repo.AdvancedSecurityEnabled attribute) (salo.events.github.audit.repo.ChangeMergeSetting attribute) (salo.events.github.audit.repo.Create attribute) (salo.events.github.audit.repo.Destroy attribute) (salo.events.github.audit.repo.RemoveMember attribute) (salo.events.github.audit.repository.ContentAnalysisDisable attribute) (salo.events.github.audit.repository.ContentAnalysisEnable attribute) (salo.events.github.audit.repository.DependencyGraphDisable attribute) (salo.events.github.audit.repository.DependencyGraphEnable attribute) (salo.events.github.audit.repository.SecretScanningDisable attribute) (salo.events.github.audit.repository.SecretScanningEnable attribute) (salo.events.github.audit.repository.VulnerabilityAlertCreate attribute) (salo.events.github.audit.repository.VulnerabilityAlertsDisable attribute) (salo.events.github.audit.repository.VulnerabilityAlertsEnable attribute) (salo.events.github.audit.team.AddMember attribute) (salo.events.github.audit.team.Create attribute) github_active (salo.events.github.audit.hook.HookModel attribute) github_actor (salo.events.github.audit.business.BusinessModel attribute) (salo.events.github.audit.git.GitModel attribute) (salo.events.github.audit.hook.HookModel attribute) (salo.events.github.audit.integration.IntegrationModel attribute) (salo.events.github.audit.org.OrgModel attribute) (salo.events.github.audit.repo.RepoModel attribute) (salo.events.github.audit.repository.RepositoryModel attribute) (salo.events.github.audit.team.TeamModel attribute) github_actor_location (salo.events.github.audit.business.AddOrganization attribute) (salo.events.github.audit.business.ImportLicenseUsage attribute) (salo.events.github.audit.business.InviteAdmin attribute) (salo.events.github.audit.git.GitModel attribute) (salo.events.github.audit.hook.HookModel attribute) (salo.events.github.audit.integration.IntegrationModel attribute) (salo.events.github.audit.org.CancelInvitation attribute) (salo.events.github.audit.org.Create attribute) (salo.events.github.audit.org.InviteMember attribute) (salo.events.github.audit.org.RemoveMember attribute) (salo.events.github.audit.org.RemoveOutsideCollaborator attribute) (salo.events.github.audit.org.UpdateTermsOfService attribute) (salo.events.github.audit.repo.RepoModel attribute) (salo.events.github.audit.repository.RepositoryModel attribute) (salo.events.github.audit.team.TeamModel attribute)

github_business (salo.events.github.audit.git.GitModel attribute) github_config (salo.events.github.audit.hook.HookModel attribute) github_config_was (salo.events.github.audit.hook.ConfigChanged attribute) github_created_at (salo.events.github.audit.business.BusinessModel attribute) (salo.events.github.audit.hook.HookModel attribute) (salo.events.github.audit.integration.IntegrationModel attribute) (salo.events.github.audit.org.OrgModel attribute) (salo.events.github.audit.repo.RepoModel attribute) (salo.events.github.audit.repository.RepositoryModel attribute) (salo.events.github.audit.team.TeamModel attribute) github_document_id (salo.events.github.audit.base.GitHubAuditModel attribute) github_events (salo.events.github.audit.hook.HookModel attribute) github_events_were (salo.events.github.audit.hook.EventsChanged attribute) github_hook_id (salo.events.github.audit.hook.HookModel attribute) github_name (salo.events.github.audit.business.BusinessModel attribute) (salo.events.github.audit.hook.HookModel attribute) (salo.events.github.audit.integration.IntegrationModel attribute) (salo.events.github.audit.repo.RepoModel attribute) github_org (salo.events.github.audit.business.AddOrganization attribute) (salo.events.github.audit.git.GitModel attribute) (salo.events.github.audit.hook.HookModel attribute) (salo.events.github.audit.org.OrgModel attribute) (salo.events.github.audit.repo.RepoModel attribute) (salo.events.github.audit.repository.RepositoryModel attribute) (salo.events.github.audit.team.TeamModel attribute) github_repo (salo.events.github.audit.git.GitModel attribute) (salo.events.github.audit.hook.Create attribute) (salo.events.github.audit.repo.RepoModel attribute) (salo.events.github.audit.repository.RepositoryModel attribute) github_repository (salo.events.github.audit.git.GitModel attribute) github_repository_public (salo.events.github.audit.git.GitModel attribute) github_team (salo.events.github.audit.team.TeamModel attribute) github_transport_protocol (salo.events.github.audit.git.GitModel attribute) github_transport_protocol_name (salo.events.github.audit.git.GitModel attribute) github_user (salo.events.github.audit.business.AddAdmin attribute) (salo.events.github.audit.business.InviteAdmin attribute) (salo.events.github.audit.org.AddMember attribute) (salo.events.github.audit.org.InviteMember attribute) (salo.events.github.audit.org.RemoveMember attribute) (salo.events.github.audit.org.RemoveOutsideCollaborator attribute) (salo.events.github.audit.org.RestoreMember attribute) (salo.events.github.audit.repo.RemoveMember attribute) (salo.events.github.audit.repository.ContentAnalysisDisable attribute) (salo.events.github.audit.repository.ContentAnalysisEnable attribute) (salo.events.github.audit.repository.DependencyGraphDisable attribute) (salo.events.github.audit.repository.DependencyGraphEnable attribute) (salo.events.github.audit.repository.SecretScanningDisable attribute) (salo.events.github.audit.repository.SecretScanningEnable attribute) (salo.events.github.audit.repository.VulnerabilityAlertsDisable attribute) (salo.events.github.audit.repository.VulnerabilityAlertsEnable attribute) (salo.events.github.audit.team.AddMember attribute) github_visibility (salo.events.github.audit.repo.Access attribute) (salo.events.github.audit.repo.AdvancedSecurityEnabled attribute) (salo.events.github.audit.repo.ChangeMergeSetting attribute) (salo.events.github.audit.repo.Create attribute) (salo.events.github.audit.repo.Destroy attribute) (salo.events.github.audit.repo.RemoveMember attribute) GitHubAuditModel (class in salo.events.github.audit.base) GitHubAuditModel.Config (class in salo.events.github.audit.base) GitModel (class in salo.events.github.audit.git)

H

hashalgs (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) HISTORIES (in module salo.events.zeek.conn) history (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) HookModel (class in salo.events.github.audit.hook) http (salo.events.suricata.http.HTTPModel attribute) (salo.events.suricata.HTTPModel attribute) http_client_header_names (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_content_type (salo.events.suricata.http.HTTPModelFull attribute) http_cookie (salo.events.suricata.http.HTTPModelFull attribute) http_cookie_vars (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_hostname (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_info_code (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_info_msg (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_length (salo.events.suricata.http.HTTPModelFull attribute) http_method (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_origin (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_password (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_port (salo.events.suricata.http.HTTPModelFull attribute) http_proxied (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_referrer (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_request_body_len (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute)

http_request_headers (salo.events.suricata.http.HTTPModelFull attribute) http_response_body_len (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_response_headers (salo.events.suricata.http.HTTPModelFull attribute) http_server_header_names (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_status_code (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_status_msg (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_tags (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_uri (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_uri_vars (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_user_agent (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_username (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) http_version (salo.events.suricata.http.HTTPModelFull attribute) (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) HTTP_VERSIONS (in module salo.events.suricata.http) (in module salo.events.zeek.http) HTTPModel (class in salo.events.suricata) (class in salo.events.suricata.http) (class in salo.events.zeek) (class in salo.events.zeek.http) HTTPModel.Config (class in salo.events.zeek) (class in salo.events.zeek.http) HTTPModelFull (class in salo.events.suricata.http) HTTPModelFull.Config (class in salo.events.suricata.http)

I

Image (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) ImportLicenseUsage (class in salo.events.github.audit.business) Initiated (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) inner_vlan (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute)

insecure_ssl (salo.events.github.audit.hook.ConfigModel attribute) IntegrationModel (class in salo.events.github.audit.integration) InviteAdmin (class in salo.events.github.audit.business) InviteMember (class in salo.events.github.audit.org) is_orig (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) issuer (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute)

J

ja3 (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) ja3s (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) jitter() (salo.cadence.Cadence method) json_encoders (salo.events.github.audit.base.GitHubAuditModel.Config attribute) (salo.events.suricata.base.SuricataModel.Config attribute) (salo.events.suricata.SuricataModel.Config attribute) (salo.events.sysmon.windows.eventcode.EventCodeModel.Config attribute) (salo.events.sysmon.windows.EventCodeModel.Config attribute) (salo.events.zeek.base.ZeekModel.Config attribute) (salo.events.zeek.ZeekModel.Config attribute)

K

keyboard_layour (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute)

Keywords (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute)

L

last_alert (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) Level (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) load_config() (salo.outputs.Sessions method) (salo.salo.Sessions method), [1] (salo.Sessions method)

local_orig (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) local_resp (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) LocalFileOutput (class in salo.outputs.localfile)

M

main() (in module salo.cli) MAX_CC (in module salo.events.zeek.smtp) MAX_DNS_ID (in module salo.events.suricata.dns) MAX_FUIDS (in module salo.events.suricata.http) (in module salo.events.zeek.http) (in module salo.events.zeek.smtp) MAX_RCPT (in module salo.events.zeek.smtp) MAX_RTT (in module salo.events.zeek.dns) MAX_TRANS_ID (in module salo.events.zeek.dns) MAX_TTL (in module salo.events.suricata.dns) (in module salo.events.zeek.dns) md5 (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) METHODS (in module salo.events.suricata.http) (in module salo.events.zeek.http) mime_type (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) missed_bytes (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) missing_bytes (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) module salo salo.__main__ salo.cadence salo.cli salo.events, [1] salo.events.github salo.events.github.audit salo.events.github.audit.base salo.events.github.audit.business salo.events.github.audit.git salo.events.github.audit.hook salo.events.github.audit.integration salo.events.github.audit.org salo.events.github.audit.repo salo.events.github.audit.repository salo.events.github.audit.team salo.events.suricata salo.events.suricata.base salo.events.suricata.dns salo.events.suricata.http salo.events.sysmon salo.events.sysmon.windows salo.events.sysmon.windows.eventcode salo.events.zeek salo.events.zeek.base salo.events.zeek.conn salo.events.zeek.dns salo.events.zeek.files salo.events.zeek.http salo.events.zeek.rdp salo.events.zeek.smtp salo.events.zeek.ssl salo.outputs, [1] salo.outputs.console salo.outputs.localfile salo.outputs.splunkhec salo.salo, [1] salo.stencils, [1] salo.stencils.cobaltstrike salo.stencils.cobaltstrike.dns salo.stencils.sunburst

N

next() (salo.cadence.Cadence method)

next_protocol (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute)

O

ocsp_status (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) Opcode (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) OrgModel (class in salo.events.github.audit.org) orig_alpn (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) orig_bytes (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) orig_filenames (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute)

orig_fuids (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) orig_ip_bytes (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) orig_l2_addr (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) orig_mime_types (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) orig_pkts (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) overflow_bytes (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute)

P

packet (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) packet_info (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) parent_fuid (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) parse_time() (salo.cadence.Cadence method) pcap_cnt (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) PHASES (in module salo.stencils.sunburst) point_formats (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) ports_protocols() (salo.events.zeek.conn.ConnModel method) (salo.events.zeek.ConnModel method) ProcessGuid (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute)

ProcessID (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) ProcessId (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) ProcessID (salo.events.sysmon.windows.EventCode3Model attribute) ProcessId (salo.events.sysmon.windows.EventCode3Model attribute) proto (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) (salo.events.zeek.dns.DNSModel attribute) (salo.events.zeek.DNSModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) protocol (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) Push (class in salo.events.github.audit.git)

Q

Q_CLASSES (in module salo.events.zeek.dns)

Q_TYPES (in module salo.events.zeek.dns)

R

random_fuid() (in module salo.events.zeek.base) random_uid() (in module salo.events.zeek.base) RCODES (in module salo.events.zeek.dns) RDPModel (class in salo.events.zeek) (class in salo.events.zeek.rdp) REGIONS (in module salo.stencils.sunburst) RemoveClientSecret (class in salo.events.github.audit.integration) RemoveMember (class in salo.events.github.audit.org) (class in salo.events.github.audit.repo) RemoveOutsideCollaborator (class in salo.events.github.audit.org) RepoModel (class in salo.events.github.audit.repo) RepositoryModel (class in salo.events.github.audit.repository) requested_color_depth (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) resp_bytes (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) resp_filenames (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute)

resp_fuids (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) resp_ip_bytes (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) resp_l2_addr (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) resp_mime_types (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) resp_pkts (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) RestoreMember (class in salo.events.github.audit.org) result (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) resumed (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) run() (salo.Event method) (salo.salo.Event method), [1] rx_hosts (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute)

S

salo module salo.__main__ module salo.cadence module salo.cli module salo.events module, [1] salo.events.github module salo.events.github.audit module salo.events.github.audit.base module salo.events.github.audit.business module salo.events.github.audit.git module salo.events.github.audit.hook module salo.events.github.audit.integration module salo.events.github.audit.org module salo.events.github.audit.repo module salo.events.github.audit.repository module salo.events.github.audit.team module salo.events.suricata module salo.events.suricata.base module salo.events.suricata.dns module salo.events.suricata.http module salo.events.sysmon module salo.events.sysmon.windows module salo.events.sysmon.windows.eventcode module salo.events.zeek module salo.events.zeek.base module salo.events.zeek.conn module salo.events.zeek.dns module salo.events.zeek.files module salo.events.zeek.http module salo.events.zeek.rdp module salo.events.zeek.smtp module salo.events.zeek.ssl module salo.outputs module, [1] salo.outputs.console module salo.outputs.localfile module salo.outputs.splunkhec module salo.salo module, [1] salo.stencils module, [1] salo.stencils.cobaltstrike module salo.stencils.cobaltstrike.dns module salo.stencils.sunburst module SALO_PATH (in module salo.salo) SaloEventModel (class in salo) (class in salo.events), [1] SaloEventModel.Config (class in salo) (class in salo.events), [1] SaloOutput (class in salo.outputs), [1] SaloStencilModel (class in salo) (class in salo.stencils), [1] SaloStencilModel.Config (class in salo) (class in salo.stencils), [1] save() (salo.outputs.console.ConsoleOutput method) (salo.outputs.localfile.LocalFileOutput method) (salo.outputs.SaloOutput method), [1] (salo.outputs.Sessions method) (salo.outputs.splunkhec.SplunkOutput method) (salo.salo.Sessions method), [1] (salo.Sessions method) save_value() (salo.Event method) (salo.salo.Event method), [1] schema_extra() (salo.events.SaloEventModel.Config static method), [1] (salo.SaloEventModel.Config static method) SecretScanningDisable (class in salo.events.github.audit.repository) SecretScanningEnable (class in salo.events.github.audit.repository) security_protocol (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) seen_bytes (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) server_key_share_group (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) server_name (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) server_supported_version (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) server_version (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) service (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 attribute) (salo.stencils.sunburst.SunBurstDNSQuery attribute) SERVICES (in module salo.events.zeek.conn) Session (class in salo) (class in salo.salo), [1] Sessions (class in salo) (class in salo.outputs) (class in salo.salo), [1] set_aa() (salo.events.suricata.dns.DNSModelFull method) set_cipher() (salo.events.zeek.ssl.SSLModel method) (salo.events.zeek.SSLModel method) set_conn_info() (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method) set_conn_state() (salo.events.zeek.conn.ConnModel method) (salo.events.zeek.ConnModel method) set_current() (salo.cadence.Cadence method) set_curve() (salo.events.zeek.ssl.SSLModel method) (salo.events.zeek.SSLModel method) set_depth() (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method) set_dest_port() (salo.events.suricata.base.SuricataModel method) (salo.events.suricata.SuricataModel method) (salo.events.sysmon.windows.eventcode.EventCode3Model method) (salo.events.sysmon.windows.EventCode3Model method) (salo.events.zeek.base.ZeekModel method) (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) (salo.events.zeek.http.HTTPModel method) (salo.events.zeek.HTTPModel method) (salo.events.zeek.rdp.RDPModel method) (salo.events.zeek.RDPModel method) (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) (salo.events.zeek.ssl.SSLModel method) (salo.events.zeek.SSLModel method) (salo.events.zeek.ZeekModel method) set_destination_is_ipv6() (salo.events.sysmon.windows.eventcode.EventCodeModel method) (salo.events.sysmon.windows.EventCodeModel method) set_dns_aa() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_dns_id() (salo.events.suricata.dns.DNSModelFull method) (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_dns_qr() (salo.events.suricata.dns.DNSModelFull method) set_dns_query() (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 method) (salo.stencils.sunburst.SunBurstDNSQuery method) set_dns_rdata() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) (salo.stencils.cobaltstrike.dns.CobaltStrikeDNSC2 method) (salo.stencils.sunburst.SunBurstDNSQuery method) set_dns_rejected() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_dns_rtt() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_dns_tc() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_dns_ttl() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_duration() (salo.events.zeek.conn.ConnModel method) (salo.events.zeek.ConnModel method) (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method) set_established() (salo.events.zeek.ssl.SSLModel method) (salo.events.zeek.SSLModel method) set_extracted_cutoff() (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method)

set_fields() (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method) set_fuids() (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_github_actor() (salo.events.github.audit.base.GitHubAuditModel method) set_github_business() (salo.events.github.audit.base.GitHubAuditModel method) set_github_config_was() (salo.events.github.audit.hook.ConfigChanged method) set_github_created_at() (salo.events.github.audit.base.GitHubAuditModel method) set_github_document_id() (salo.events.github.audit.base.GitHubAuditModel method) set_github_events_were() (salo.events.github.audit.hook.EventsChanged method) set_github_hook_id() (salo.events.github.audit.base.GitHubAuditModel method) set_github_name() (salo.events.github.audit.base.GitHubAuditModel method) set_github_org() (salo.events.github.audit.base.GitHubAuditModel method) set_github_repo() (salo.events.github.audit.base.GitHubAuditModel method) set_github_repository() (salo.events.github.audit.base.GitHubAuditModel method) set_github_team() (salo.events.github.audit.base.GitHubAuditModel method) set_github_user() (salo.events.github.audit.base.GitHubAuditModel method) set_github_visibility() (salo.events.github.audit.base.GitHubAuditModel method) set_history() (salo.events.zeek.conn.ConnModel method) (salo.events.zeek.ConnModel method) set_http_status_code() (salo.events.suricata.http.HTTPModelFull method) set_http_version() (salo.events.suricata.http.HTTPModelFull method) (salo.events.zeek.http.HTTPModel method) (salo.events.zeek.HTTPModel method) set_Image() (salo.events.sysmon.windows.eventcode.EventCode3Model method) (salo.events.sysmon.windows.EventCode3Model method) set_is_orig() (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method) set_is_webmail() (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_options() (salo.Event method) (salo.salo.Event method), [1] set_proto() (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_protocol() (salo.events.sysmon.windows.eventcode.EventCode3Model method) (salo.events.sysmon.windows.EventCode3Model method) set_ra() (salo.events.suricata.dns.DNSModelFull method) (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_rd() (salo.events.suricata.dns.DNSModelFull method) (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) set_resumed() (salo.events.zeek.ssl.SSLModel method) (salo.events.zeek.SSLModel method) set_smtp_msg_id() (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_smtp_path() (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_smtp_tls() (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_smtp_trans_depth() (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_source_is_ipv6() (salo.events.sysmon.windows.eventcode.EventCodeModel method) (salo.events.sysmon.windows.EventCodeModel method) set_src_port() (salo.events.suricata.base.SuricataModel method) (salo.events.suricata.SuricataModel method) (salo.events.sysmon.windows.eventcode.EventCode3Model method) (salo.events.sysmon.windows.EventCode3Model method) (salo.events.zeek.base.ZeekModel method) (salo.events.zeek.ZeekModel method) set_tc() (salo.events.suricata.dns.DNSModelFull method) set_timedout() (salo.events.zeek.files.FilesModel method) (salo.events.zeek.FilesModel method) set_User() (salo.events.sysmon.windows.eventcode.EventCode3Model method) (salo.events.sysmon.windows.EventCode3Model method) set_utctime() (salo.events.sysmon.windows.eventcode.EventCodeModel method) (salo.events.sysmon.windows.EventCodeModel method) set_values() (salo.events.suricata.dns.DNSModel method) (salo.events.suricata.dns.DNSModelFull method) (salo.events.suricata.DNSModel method) (salo.events.suricata.http.HTTPModel method) (salo.events.suricata.HTTPModel method) (salo.events.zeek.dns.DNSModel method) (salo.events.zeek.DNSModel method) (salo.events.zeek.http.HTTPModel method) (salo.events.zeek.HTTPModel method) (salo.events.zeek.smtp.SMTPModel method) (salo.events.zeek.SMTPModel method) set_version() (salo.events.zeek.ssl.SSLModel method) (salo.events.zeek.SSLModel method) sha1 (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) sha256 (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) sigalgs (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) smtp_cc (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_entity_count (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_first_received (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_from (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_has_client_activity (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_helo (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_in_reply_to (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_is_webmail (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_last_reply (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_mailfrom (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_msg_id (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_path (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_process_received_from (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_process_smtp_headers (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_rcptto (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_reply_to (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_second_received (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_subject (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_tls (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_to (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_trans_depth (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_user_agent (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) smtp_x_originating_ip (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) SMTPModel (class in salo.events.zeek) (class in salo.events.zeek.smtp) SMTPModel.Config (class in salo.events.zeek) (class in salo.events.zeek.smtp) sni_matches_cert (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) source (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) SourceHostname (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) SourceIsIpv6 (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) SourcePortName (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) spawn() (salo.salo.Session method), [1] (salo.Session method) speculative_service (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) SplunkOutput (class in salo.outputs.splunkhec) src_ip (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) (salo.events.zeek.base.ZeekModel attribute) (salo.events.zeek.ZeekModel attribute) src_port (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) (salo.events.zeek.base.ZeekModel attribute) (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) (salo.events.zeek.ZeekModel attribute) ssl (salo.events.zeek.rdp.RDPModel attribute) (salo.events.zeek.RDPModel attribute) ssl_client_exts (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) ssl_history (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) ssl_server_exts (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) SSLModel (class in salo.events.zeek) (class in salo.events.zeek.ssl) STATUSES (in module salo.events.suricata.http) (in module salo.events.zeek.http) subject (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) sunburst_phase (salo.stencils.sunburst.SunBurstDNSQuery attribute) SunBurstDNSQuery (class in salo.stencils.sunburst) SuricataModel (class in salo.events.suricata) (class in salo.events.suricata.base) SuricataModel.Config (class in salo.events.suricata) (class in salo.events.suricata.base)

T

Task (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) TeamModel (class in salo.events.github.audit.team) ThreadID (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) ticket_lifetime_hint (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) timedout (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) timestamp (salo.events.github.audit.base.GitHubAuditModel attribute) (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute) (salo.events.sysmon.windows.eventcode.EventCodeModel attribute) (salo.events.sysmon.windows.EventCodeModel attribute) (salo.events.zeek.base.ZeekModel attribute) (salo.events.zeek.smtp.SMTPModel attribute) (salo.events.zeek.SMTPModel attribute) (salo.events.zeek.ZeekModel attribute)

TLS_CIPHERS (in module salo.events.zeek.ssl) TLS_CURVES (in module salo.events.zeek.ssl) TLS_VERSIONS (in module salo.events.zeek.ssl) total_bytes (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) trans_depth (salo.events.zeek.http.HTTPModel attribute) (salo.events.zeek.HTTPModel attribute) tunnel_parents (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) tx_hosts (salo.events.zeek.files.FilesModel attribute) (salo.events.zeek.FilesModel attribute) tx_id (salo.events.suricata.base.SuricataModel attribute) (salo.events.suricata.SuricataModel attribute)

U

uid (salo.events.zeek.base.ZeekModel attribute) (salo.events.zeek.ZeekModel attribute) underscore_attrs_are_private (salo.events.SaloEventModel.Config attribute), [1] (salo.SaloEventModel.Config attribute) update_cadence() (salo.cadence.Cadence method) (salo.Event method) (salo.salo.Event method), [1] update_saved_values() (salo.Event method) (salo.salo.Event method), [1]

UpdateTermsOfService (class in salo.events.github.audit.org) url (salo.events.github.audit.hook.ConfigModel attribute) User (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) UserID (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) UtcTime (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute)

V

valid_ct_logs (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) valid_ct_operators (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) validate_assignment (salo.events.SaloEventModel.Config attribute), [1] (salo.SaloEventModel.Config attribute) (salo.SaloStencilModel.Config attribute) (salo.stencils.SaloStencilModel.Config attribute), [1] validation_status (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute)

Version (salo.events.sysmon.windows.eventcode.EventCode3Model attribute) (salo.events.sysmon.windows.EventCode3Model attribute) version (salo.events.zeek.ssl.SSLModel attribute) (salo.events.zeek.SSLModel attribute) vlan (salo.events.zeek.conn.ConnModel attribute) (salo.events.zeek.ConnModel attribute) VulnerabilityAlertCreate (class in salo.events.github.audit.repository) VulnerabilityAlertsDisable (class in salo.events.github.audit.repository) VulnerabilityAlertsEnable (class in salo.events.github.audit.repository)

Z

ZeekModel (class in salo.events.zeek) (class in salo.events.zeek.base)

ZeekModel.Config (class in salo.events.zeek) (class in salo.events.zeek.base)