mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 08:38:20 +00:00
Convert more redef-able constants to runtime options
This commit is contained in:
parent
4912513517
commit
01a899255e
36 changed files with 72 additions and 72 deletions
|
@ -28,11 +28,11 @@ export {
|
|||
};
|
||||
|
||||
## Analyzers which you don't want to throw
|
||||
const ignore_violations: set[Analyzer::Tag] = set() &redef;
|
||||
option ignore_violations: set[Analyzer::Tag] = set();
|
||||
|
||||
## Ignore violations which go this many bytes into the connection.
|
||||
## Set to 0 to never ignore protocol violations.
|
||||
const ignore_violations_after = 10 * 1024 &redef;
|
||||
option ignore_violations_after = 10 * 1024;
|
||||
}
|
||||
|
||||
redef record connection += {
|
||||
|
|
|
@ -130,7 +130,7 @@ export {
|
|||
const analyze_by_mime_type_automatically = T &redef;
|
||||
|
||||
## The default setting for file reassembly.
|
||||
const enable_reassembler = T &redef;
|
||||
option enable_reassembler = T;
|
||||
|
||||
## The default per-file reassembly buffer size.
|
||||
const reassembly_buffer_size = 524288 &redef;
|
||||
|
|
|
@ -26,7 +26,7 @@ export {
|
|||
|
||||
## Notice types which should have the "remote" location looked up.
|
||||
## If GeoIP support is not built in, this does nothing.
|
||||
const lookup_location_types: set[Notice::Type] = {} &redef;
|
||||
option lookup_location_types: set[Notice::Type] = {};
|
||||
}
|
||||
|
||||
hook policy(n: Notice::Info) &priority=10
|
||||
|
|
|
@ -14,7 +14,7 @@ export {
|
|||
|
||||
## Email address to send notices with the :bro:enum:`Notice::ACTION_PAGE`
|
||||
## action.
|
||||
const mail_page_dest = "" &redef;
|
||||
option mail_page_dest = "";
|
||||
}
|
||||
|
||||
hook notice(n: Notice::Info) &priority=-5
|
||||
|
|
|
@ -173,13 +173,13 @@ export {
|
|||
};
|
||||
|
||||
## Ignored notice types.
|
||||
const ignored_types: set[Notice::Type] = {} &redef;
|
||||
option ignored_types: set[Notice::Type] = {};
|
||||
## Emailed notice types.
|
||||
const emailed_types: set[Notice::Type] = {} &redef;
|
||||
option emailed_types: set[Notice::Type] = {};
|
||||
## Alarmed notice types.
|
||||
const alarmed_types: set[Notice::Type] = {} &redef;
|
||||
option alarmed_types: set[Notice::Type] = {};
|
||||
## Types that should be suppressed for the default suppression interval.
|
||||
const not_suppressed_types: set[Notice::Type] = {} &redef;
|
||||
option not_suppressed_types: set[Notice::Type] = {};
|
||||
## This table can be used as a shorthand way to modify suppression
|
||||
## intervals for entire notice types.
|
||||
const type_suppression_intervals: table[Notice::Type] of interval = {} &redef;
|
||||
|
@ -190,7 +190,7 @@ export {
|
|||
## Local system sendmail program.
|
||||
##
|
||||
## Note that this is overridden by the BroControl SendMail option.
|
||||
const sendmail = "/usr/sbin/sendmail" &redef;
|
||||
option sendmail = "/usr/sbin/sendmail";
|
||||
## Email address to send notices with the
|
||||
## :bro:enum:`Notice::ACTION_EMAIL` action or to send bulk alarm logs
|
||||
## on rotation with :bro:enum:`Notice::ACTION_ALARM`.
|
||||
|
|
|
@ -255,14 +255,14 @@ export {
|
|||
|
||||
## To completely ignore a specific weird for a host, add the host
|
||||
## and weird name into this set.
|
||||
const ignore_hosts: set[addr, string] &redef;
|
||||
option ignore_hosts: set[addr, string];
|
||||
|
||||
## Don't ignore repeats for weirds in this set. For example,
|
||||
## it's handy keeping track of clustered checksum errors.
|
||||
const weird_do_not_ignore_repeats = {
|
||||
option weird_do_not_ignore_repeats = {
|
||||
"bad_IP_checksum", "bad_TCP_checksum", "bad_UDP_checksum",
|
||||
"bad_ICMP_checksum",
|
||||
} &redef;
|
||||
};
|
||||
|
||||
## This table is used to track identifier and name pairs that should be
|
||||
## temporarily ignored because the problem has already been reported.
|
||||
|
|
|
@ -104,7 +104,7 @@ export {
|
|||
} &redef &default = SIG_ALARM;
|
||||
|
||||
## Signature IDs that should always be ignored.
|
||||
const ignored_ids = /NO_DEFAULT_MATCHES/ &redef;
|
||||
option ignored_ids = /NO_DEFAULT_MATCHES/;
|
||||
|
||||
## Generate a notice if, for a pair [orig, signature], the number of
|
||||
## different responders has reached one of the thresholds.
|
||||
|
@ -120,7 +120,7 @@ export {
|
|||
|
||||
## The interval between when :bro:enum:`Signatures::Signature_Summary`
|
||||
## notices are generated.
|
||||
const summary_interval = 1 day &redef;
|
||||
option summary_interval = 1 day;
|
||||
|
||||
## This event can be handled to access/alter data about to be logged
|
||||
## to the signature logging stream.
|
||||
|
|
|
@ -68,7 +68,7 @@ export {
|
|||
|
||||
## Hosts whose software should be detected and tracked.
|
||||
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS.
|
||||
const asset_tracking = LOCAL_HOSTS &redef;
|
||||
option asset_tracking = LOCAL_HOSTS;
|
||||
|
||||
## Other scripts should call this function when they detect software.
|
||||
##
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue