Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Change doc/ subdir into a git submodule

Browse source 
The docs now live at https://github.com/zeek/zeek-docs
This commit is contained in:
Jon Siwek 2019-01-17 14:09:29 -06:00
parent 0d685efbf5
commit 2ff746fea7
693 changed files with 26 additions and 105609 deletions
Download patch file Download diff file Expand all files Collapse all files

14
doc/scripts/policy/integration/barnyard2/__load__.bro.rst
View file

@ -1,14 +0,0 @@
:tocdepth: 3
policy/integration/barnyard2/__load__.bro
=========================================
:Imports: :doc:`policy/integration/barnyard2/main.bro </scripts/policy/integration/barnyard2/main.bro>`, :doc:`policy/integration/barnyard2/types.bro </scripts/policy/integration/barnyard2/types.bro>`
Summary
~~~~~~~
Detailed Interface
~~~~~~~~~~~~~~~~~~

21
doc/scripts/policy/integration/barnyard2/index.rst
View file

@ -1,21 +0,0 @@
:orphan:
Package: policy/integration/barnyard2
=====================================
Integration with Barnyard2.
:doc:`/scripts/policy/integration/barnyard2/__load__.bro`
:doc:`/scripts/policy/integration/barnyard2/types.bro`
This file is separate from the base script so that dependencies can
be loaded in the correct order.
:doc:`/scripts/policy/integration/barnyard2/main.bro`
This script lets Barnyard2 integrate with Bro. It receives alerts from
Barnyard2 and logs them. In the future it will do more correlation
and derive new notices from the alerts.

65
doc/scripts/policy/integration/barnyard2/main.bro.rst
View file

@ -1,65 +0,0 @@
:tocdepth: 3
policy/integration/barnyard2/main.bro
=====================================
.. bro:namespace:: Barnyard2
This script lets Barnyard2 integrate with Bro. It receives alerts from
Barnyard2 and logs them. In the future it will do more correlation
and derive new notices from the alerts.
:Namespace: Barnyard2
:Imports: :doc:`policy/integration/barnyard2/types.bro </scripts/policy/integration/barnyard2/types.bro>`
Summary
~~~~~~~
Types
#####
=============================================== =
:bro:type:`Barnyard2::Info`: :bro:type:`record`
=============================================== =
Redefinitions
#############
===================================== =
:bro:type:`Log::ID`: :bro:type:`enum`
===================================== =
Functions
#########
================================================== =====================================================================
:bro:id:`Barnyard2::pid2cid`: :bro:type:`function` This can convert a Barnyard :bro:type:`Barnyard2::PacketID` value to
a :bro:type:`conn_id` value in the case that you might need to index
into an existing data structure elsewhere within Bro.
================================================== =====================================================================
Detailed Interface
~~~~~~~~~~~~~~~~~~
Types
#####
.. bro:type:: Barnyard2::Info
:Type: :bro:type:`record`
ts: :bro:type:`time` :bro:attr:`&log`
Timestamp of the alert.
pid: :bro:type:`Barnyard2::PacketID` :bro:attr:`&log`
Associated packet ID.
alert: :bro:type:`Barnyard2::AlertData` :bro:attr:`&log`
Associated alert data.
Functions
#########
.. bro:id:: Barnyard2::pid2cid
:Type: :bro:type:`function` (p: :bro:type:`Barnyard2::PacketID`) : :bro:type:`conn_id`
This can convert a Barnyard :bro:type:`Barnyard2::PacketID` value to
a :bro:type:`conn_id` value in the case that you might need to index
into an existing data structure elsewhere within Bro.

89
doc/scripts/policy/integration/barnyard2/types.bro.rst
View file

@ -1,89 +0,0 @@
:tocdepth: 3
policy/integration/barnyard2/types.bro
======================================
.. bro:namespace:: Barnyard2
This file is separate from the base script so that dependencies can
be loaded in the correct order.
:Namespace: Barnyard2
Summary
~~~~~~~
Types
#####
===================================================================== =
:bro:type:`Barnyard2::AlertData`: :bro:type:`record` :bro:attr:`&log`
:bro:type:`Barnyard2::PacketID`: :bro:type:`record` :bro:attr:`&log`
===================================================================== =
Events
######
====================================================== ================================================================
:bro:id:`Barnyard2::barnyard_alert`: :bro:type:`event` This is the event that Barnyard2 instances will send if they're
configured with the bro_alert output plugin.
====================================================== ================================================================
Detailed Interface
~~~~~~~~~~~~~~~~~~
Types
#####
.. bro:type:: Barnyard2::AlertData
:Type: :bro:type:`record`
sensor_id: :bro:type:`count` :bro:attr:`&log`
Sensor that originated this event.
ts: :bro:type:`time` :bro:attr:`&log`
Timestamp attached to the alert.
signature_id: :bro:type:`count` :bro:attr:`&log`
Sig id for this generator.
generator_id: :bro:type:`count` :bro:attr:`&log`
Which generator generated the alert?
signature_revision: :bro:type:`count` :bro:attr:`&log`
Sig revision for this id.
classification_id: :bro:type:`count` :bro:attr:`&log`
Event classification.
classification: :bro:type:`string` :bro:attr:`&log`
Descriptive classification string.
priority_id: :bro:type:`count` :bro:attr:`&log`
Event priority.
event_id: :bro:type:`count` :bro:attr:`&log`
Event ID.
:Attributes: :bro:attr:`&log`
.. bro:type:: Barnyard2::PacketID
:Type: :bro:type:`record`
src_ip: :bro:type:`addr` :bro:attr:`&log`
src_p: :bro:type:`port` :bro:attr:`&log`
dst_ip: :bro:type:`addr` :bro:attr:`&log`
dst_p: :bro:type:`port` :bro:attr:`&log`
:Attributes: :bro:attr:`&log`
Events
######
.. bro:id:: Barnyard2::barnyard_alert
:Type: :bro:type:`event` (id: :bro:type:`Barnyard2::PacketID`, alert: :bro:type:`Barnyard2::AlertData`, msg: :bro:type:`string`, data: :bro:type:`string`)
This is the event that Barnyard2 instances will send if they're
configured with the bro_alert output plugin.

14
doc/scripts/policy/integration/collective-intel/__load__.bro.rst
View file

@ -1,14 +0,0 @@
:tocdepth: 3
policy/integration/collective-intel/__load__.bro
================================================
:Imports: :doc:`policy/integration/collective-intel/main.bro </scripts/policy/integration/collective-intel/main.bro>`
Summary
~~~~~~~
Detailed Interface
~~~~~~~~~~~~~~~~~~

16
doc/scripts/policy/integration/collective-intel/index.rst
View file

@ -1,16 +0,0 @@
:orphan:
Package: policy/integration/collective-intel
============================================
The scripts in this module are for deeper integration with the
Collective Intelligence Framework (CIF) since Bro's Intel framework
doesn't natively behave the same as CIF nor does it store and maintain
the same data in all cases.
:doc:`/scripts/policy/integration/collective-intel/__load__.bro`
:doc:`/scripts/policy/integration/collective-intel/main.bro`

23
doc/scripts/policy/integration/collective-intel/main.bro.rst
View file

@ -1,23 +0,0 @@
:tocdepth: 3
policy/integration/collective-intel/main.bro
============================================
.. bro:namespace:: Intel
:Namespace: Intel
:Imports: :doc:`base/frameworks/intel </scripts/base/frameworks/intel/index>`
Summary
~~~~~~~
Redefinitions
#############
=============================================== =======================================================================
:bro:type:`Intel::MetaData`: :bro:type:`record` These are some fields to add extended compatibility between Bro and the
Collective Intelligence Framework.
=============================================== =======================================================================
Detailed Interface
~~~~~~~~~~~~~~~~~~