Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix geo-data to log remote_location data when auth is successful.

Browse source
This commit is contained in:
Michael Dopheide 2019-03-13 14:14:38 -05:00
parent 56da70c148
commit 0f6f6cdb29
1 changed files with 1 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/policy/protocols/ssh/geo-data.bro
View file

@ -35,9 +35,6 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3
if ( ! c$ssh?$direction ) if ( ! c$ssh?$direction )
return; return;
# Add the location data to the SSH record.
c$ssh$remote_location = get_location(c);
if ( c$ssh$remote_location?$country_code && c$ssh$remote_location$country_code in watched_countries ) if ( c$ssh$remote_location?$country_code && c$ssh$remote_location$country_code in watched_countries )
{ {
NOTICE([$note=Watched_Country_Login, NOTICE([$note=Watched_Country_Login,
@ -48,7 +45,7 @@ event ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3
} }
} }
event ssh_auth_failed(c: connection) &priority=3 event ssh_auth_attempted(c: connection, authenticated: bool) &priority=3
{ {
if ( ! c$ssh?$direction ) if ( ! c$ssh?$direction )
return; return;