Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Allow to track service violations in conn.log.

Browse source 
This introduces ian options, DPD::track_removed_services_in_connection.
It adds failed services to the services column, prefixed with a
"-".

Alternatively, this commit also adds
policy/protocols/conn/failed-services.zeek, which provides the same
information in a new column in conn.log.
This commit is contained in:
Johanna Amann 2025-01-30 16:32:32 +00:00
parent ac7bbe6949
commit 2f712c3c24
8 changed files with 67 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
scripts/base/protocols/conn/main.zeek
View file

@ -31,6 +31,9 @@ export {
## the connection. Can list more than one protocol separated with
## colons. Protocols listed are in the order in which they are
## confirmed.
## This field can also contain a list of protocol analyzers that
## raise violations prefixed with a "-" if the option
## :zeek:see:`DPD::track_removed_services_in_connection` is set.
service: string &log &optional;
## How long the connection lasted.
##