mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
Change doc/ subdir into a git submodule
The docs now live at https://github.com/zeek/zeek-docs
This commit is contained in:
Jon Siwek
parent
0d685efbf5
commit
2ff746fea7
693 changed files with 26 additions and 105609 deletions
|
|
@ -1,91 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
policy/protocols/modbus/known-masters-slaves.bro
|
||||
================================================
|
||||
.. bro:namespace:: Known
|
||||
|
||||
Script for tracking known Modbus masters and slaves.
|
||||
|
||||
.. todo:: This script needs a lot of work. What might be more interesting
|
||||
is to track master/slave relationships based on commands sent and
|
||||
successful (non-exception) responses.
|
||||
|
||||
:Namespace: Known
|
||||
:Imports: :doc:`base/protocols/modbus </scripts/base/protocols/modbus/index>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
State Variables
|
||||
###############
|
||||
========================================================================================================== ===============================
|
||||
:bro:id:`Known::modbus_nodes`: :bro:type:`set` :bro:attr:`&create_expire` = ``1.0 day`` :bro:attr:`&redef` The Modbus nodes being tracked.
|
||||
========================================================================================================== ===============================
|
||||
|
||||
Types
|
||||
#####
|
||||
===================================================== =
|
||||
:bro:type:`Known::ModbusDeviceType`: :bro:type:`enum`
|
||||
:bro:type:`Known::ModbusInfo`: :bro:type:`record`
|
||||
===================================================== =
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
===================================== =
|
||||
:bro:type:`Log::ID`: :bro:type:`enum`
|
||||
===================================== =
|
||||
|
||||
Events
|
||||
######
|
||||
==================================================== =====================================================================
|
||||
:bro:id:`Known::log_known_modbus`: :bro:type:`event` Event that can be handled to access the loggable record as it is sent
|
||||
on to the logging framework.
|
||||
==================================================== =====================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
State Variables
|
||||
###############
|
||||
.. bro:id:: Known::modbus_nodes
|
||||
|
||||
:Type: :bro:type:`set` [:bro:type:`addr`, :bro:type:`Known::ModbusDeviceType`]
|
||||
:Attributes: :bro:attr:`&create_expire` = ``1.0 day`` :bro:attr:`&redef`
|
||||
:Default: ``{}``
|
||||
|
||||
The Modbus nodes being tracked.
|
||||
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: Known::ModbusDeviceType
|
||||
|
||||
:Type: :bro:type:`enum`
|
||||
|
||||
.. bro:enum:: Known::MODBUS_MASTER Known::ModbusDeviceType
|
||||
|
||||
.. bro:enum:: Known::MODBUS_SLAVE Known::ModbusDeviceType
|
||||
|
||||
|
||||
.. bro:type:: Known::ModbusInfo
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
ts: :bro:type:`time` :bro:attr:`&log`
|
||||
The time the device was discovered.
|
||||
|
||||
host: :bro:type:`addr` :bro:attr:`&log`
|
||||
The IP address of the host.
|
||||
|
||||
device_type: :bro:type:`Known::ModbusDeviceType` :bro:attr:`&log`
|
||||
The type of device being tracked.
|
||||
|
||||
|
||||
Events
|
||||
######
|
||||
.. bro:id:: Known::log_known_modbus
|
||||
|
||||
:Type: :bro:type:`event` (rec: :bro:type:`Known::ModbusInfo`)
|
||||
|
||||
Event that can be handled to access the loggable record as it is sent
|
||||
on to the logging framework.
|
||||
|
||||
|
||||
|
|
@ -1,126 +0,0 @@
|
|||
:tocdepth: 3
|
||||
|
||||
policy/protocols/modbus/track-memmap.bro
|
||||
========================================
|
||||
.. bro:namespace:: Modbus
|
||||
|
||||
This script tracks the memory map of holding (read/write) registers and logs
|
||||
changes as they are discovered.
|
||||
|
||||
.. todo:: Not all register read and write functions are supported yet.
|
||||
|
||||
:Namespace: Modbus
|
||||
:Imports: :doc:`base/protocols/modbus </scripts/base/protocols/modbus/index>`, :doc:`base/utils/directions-and-hosts.bro </scripts/base/utils/directions-and-hosts.bro>`
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
=================================================================== ==================================================
|
||||
:bro:id:`Modbus::track_memmap`: :bro:type:`Host` :bro:attr:`&redef` The hosts that should have memory mapping enabled.
|
||||
=================================================================== ==================================================
|
||||
|
||||
State Variables
|
||||
###############
|
||||
===================================================== =======================================================
|
||||
:bro:id:`Modbus::device_registers`: :bro:type:`table` The memory map of slaves is tracked with this variable.
|
||||
===================================================== =======================================================
|
||||
|
||||
Types
|
||||
#####
|
||||
===================================================== =====================================================================
|
||||
:bro:type:`Modbus::MemmapInfo`: :bro:type:`record`
|
||||
:bro:type:`Modbus::RegisterValue`: :bro:type:`record`
|
||||
:bro:type:`Modbus::Registers`: :bro:type:`table` Indexed on the device register value and yielding the register value.
|
||||
===================================================== =====================================================================
|
||||
|
||||
Redefinitions
|
||||
#############
|
||||
============================================ =
|
||||
:bro:type:`Log::ID`: :bro:type:`enum`
|
||||
:bro:type:`Modbus::Info`: :bro:type:`record`
|
||||
============================================ =
|
||||
|
||||
Events
|
||||
######
|
||||
===================================================== =====================================================================
|
||||
:bro:id:`Modbus::changed_register`: :bro:type:`event` This event is generated every time a register is seen to be different
|
||||
than it was previously seen to be.
|
||||
===================================================== =====================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Runtime Options
|
||||
###############
|
||||
.. bro:id:: Modbus::track_memmap
|
||||
|
||||
:Type: :bro:type:`Host`
|
||||
:Attributes: :bro:attr:`&redef`
|
||||
:Default: ``ALL_HOSTS``
|
||||
|
||||
The hosts that should have memory mapping enabled.
|
||||
|
||||
State Variables
|
||||
###############
|
||||
.. bro:id:: Modbus::device_registers
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`addr`] of :bro:type:`Modbus::Registers`
|
||||
:Default: ``{}``
|
||||
|
||||
The memory map of slaves is tracked with this variable.
|
||||
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: Modbus::MemmapInfo
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
ts: :bro:type:`time` :bro:attr:`&log`
|
||||
Timestamp for the detected register change.
|
||||
|
||||
uid: :bro:type:`string` :bro:attr:`&log`
|
||||
Unique ID for the connection.
|
||||
|
||||
id: :bro:type:`conn_id` :bro:attr:`&log`
|
||||
Connection ID.
|
||||
|
||||
register: :bro:type:`count` :bro:attr:`&log`
|
||||
The device memory offset.
|
||||
|
||||
old_val: :bro:type:`count` :bro:attr:`&log`
|
||||
The old value stored in the register.
|
||||
|
||||
new_val: :bro:type:`count` :bro:attr:`&log`
|
||||
The new value stored in the register.
|
||||
|
||||
delta: :bro:type:`interval` :bro:attr:`&log`
|
||||
The time delta between when the *old_val* and *new_val* were
|
||||
seen.
|
||||
|
||||
|
||||
.. bro:type:: Modbus::RegisterValue
|
||||
|
||||
:Type: :bro:type:`record`
|
||||
|
||||
last_set: :bro:type:`time`
|
||||
|
||||
value: :bro:type:`count`
|
||||
|
||||
|
||||
.. bro:type:: Modbus::Registers
|
||||
|
||||
:Type: :bro:type:`table` [:bro:type:`count`] of :bro:type:`Modbus::RegisterValue`
|
||||
|
||||
Indexed on the device register value and yielding the register value.
|
||||
|
||||
Events
|
||||
######
|
||||
.. bro:id:: Modbus::changed_register
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, register: :bro:type:`count`, old_val: :bro:type:`count`, new_val: :bro:type:`count`, delta: :bro:type:`interval`)
|
||||
|
||||
This event is generated every time a register is seen to be different
|
||||
than it was previously seen to be.
|
||||
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue