Add option to ignore attempted (but not successful) connections

[Jeremy-Easi]

We are facing RITA reporting a lot of detections for connections that are actually blocked by the firewall.

This is particularly annoying because these connections have very few information (no fqdn, no service) as zeek could not really see data to analyze (except initial SYN) so it's difficult to identity them to safely filter them out.

It would be interesting to have an option in the RITA config to not import entries from conn.log with a conn_state=S0 (which means "Connection attempt seen, no reply") as this is typically a sign that the connection was blocked somewhere along the path (likely by the perimeter firewall).

I recognize that it may also mean that the C2 server is down, but whenever it would be UP and there would be connections, these logs would not be with a conn_state=0 anymore and hence would be processed by RITA. Moreover as it would be an option, one can decide to enable it or not.

[David-Aires]

@Jeremy-Easi I have created a pull request addressing your issue request.

This PR introduces a new FilterFailedConnections option in the RITA config, allowing users to exclude conn_state = 'S0' entries from conn.log and open_conn.log. This helps reduce noise from connections blocked by firewalls, aligning with your proposal.

Let me know if you have any feedback! 🚀

🔗 Link to the Pull Request