Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixed intel expiration reset.

Browse source 
Reinserting the same indicator did not reset the expiration timer for
the indicator in the underlying data store.

Addresses BIT-1790
This commit is contained in:
Jan Grashoefer 2017-02-09 19:36:05 +01:00
parent 86271f2bdf
commit 209a560cc6
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/frameworks/intel/main.bro
View file

@ -407,7 +407,11 @@ function insert(item: Item)
if ( host !in data_store$host_data )
data_store$host_data[host] = table();
else
{
is_new = F;
# Reset expiration timer.
data_store$host_data[host] = data_store$host_data[host];
}
meta_tbl = data_store$host_data[host];
}
@ -422,7 +426,11 @@ function insert(item: Item)
if ( !check_subnet(net, data_store$subnet_data) )
data_store$subnet_data[net] = table();
else
{
is_new = F;
# Reset expiration timer.
data_store$subnet_data[net] = data_store$subnet_data[net];
}
meta_tbl = data_store$subnet_data[net];
}
@ -436,7 +444,12 @@ function insert(item: Item)
if ( [lower_indicator, item$indicator_type] !in data_store$string_data )
data_store$string_data[lower_indicator, item$indicator_type] = table();
else
{
is_new = F;
# Reset expiration timer.
data_store$string_data[lower_indicator, item$indicator_type] =
data_store$string_data[lower_indicator, item$indicator_type];
}
meta_tbl = data_store$string_data[lower_indicator, item$indicator_type];
}