Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SSH::Interesting_Hostname_Login cleanup. Fixes #664.

Browse source
This commit is contained in:
Seth Hall 2011-12-10 00:13:37 -05:00
parent 3391270527
commit 00fb187927
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/policy/protocols/ssh/interesting-hostnames.bro
View file

@ -36,7 +36,9 @@ event SSH::heuristic_successful_login(c: connection)
if ( interesting_hostnames in hostname ) if ( interesting_hostnames in hostname )
{ {
NOTICE([$note=Interesting_Hostname_Login, NOTICE([$note=Interesting_Hostname_Login,
$msg=fmt("Interesting login from hostname: %s", hostname), $msg=fmt("Possible SSH login involving a %s %s with an interesting hostname.",
Site::is_local_addr(host) ? "local" : "remote",
host == c$id$orig_h ? "client" : "server"),
$sub=hostname, $conn=c]); $sub=hostname, $conn=c]);
} }
} }