Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'topic/jgras/bit-1679' of https://github.com/J-Gras/bro into J-Gras-topic/jgras/bit-1679

Browse source
This commit is contained in:
Seth Hall 2016-10-02 14:21:19 -04:00
commit 20fc6398be
4 changed files with 86 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

31
testing/btest/scripts/base/frameworks/intel/remove-non-existing.bro Normal file
View file

@ -0,0 +1,31 @@
# @TEST-EXEC: btest-bg-run broproc bro %INPUT
# @TEST-EXEC: btest-bg-wait -k 5
# @TEST-EXEC: cat broproc/reporter.log > output
# @TEST-EXEC: cat broproc/.stdout >> output
# @TEST-EXEC: btest-diff output
# @TEST-START-FILE intel.dat
#fields indicator indicator_type meta.source meta.desc meta.url
192.168.1.1 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/1
# @TEST-END-FILE
@load frameworks/communication/listen
redef Intel::read_files += { "../intel.dat" };
redef enum Intel::Where += { SOMEWHERE };
event do_it()
{
# not existing meta data:
Intel::remove([$indicator="192.168.1.1", $indicator_type=Intel::ADDR, $meta=[$source="source23"]]);
# existing:
Intel::remove([$indicator="192.168.1.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
# not existing item:
Intel::remove([$indicator="192.168.1.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
terminate();
}
event bro_init() &priority=-10
{
schedule 1sec { do_it() };
}