Anything from Zenarmor/Sensei for Log4Shell?

[lrosenman]

With the latest fun & frolic from Log4Shell, is/are there any rules/help from Sensei/Zenarmor?

[sy]

Hi,

Elasticsearch package is updated to the 5.6.8_6. You need to run OPNsense update.

[athurdent]

Hi,

Elasticsearch package is updated to the 5.6.8_6. You need to run OPNsense update.

Great, many thanks @sy!
Update went fine, everything OK so far.

[lrosenman]

I was more thinking about blocking attempts to exploit the vulnerability. But thanks for the info on ElasticSearch.  I'm using a remote ES.  And I updated OPNsense.

[almodovaris]

Now updated to elasticsearch5-5.6.8_7

[lrosenman]

Anything at all on rules/waf side?

[athurdent]

Anything at all on rules/waf side?

Zenarmor is primarily used to protect client traffic. AFAIK it's not meant to be a WAF. You should probably look into Suricata for this.