diff --git a/scripts/base/protocols/ssh/main.bro b/scripts/base/protocols/ssh/main.bro index 4c2af3ee42..836676af37 100644 --- a/scripts/base/protocols/ssh/main.bro +++ b/scripts/base/protocols/ssh/main.bro @@ -9,6 +9,7 @@ @load base/utils/site @load base/utils/thresholds @load base/utils/conn-ids +@load base/utils/directions-and-hosts module SSH; diff --git a/scripts/policy/protocols/ssh/detect-bruteforcing.bro b/scripts/policy/protocols/ssh/detect-bruteforcing.bro index 36e73bfa59..10c5019f27 100644 --- a/scripts/policy/protocols/ssh/detect-bruteforcing.bro +++ b/scripts/policy/protocols/ssh/detect-bruteforcing.bro @@ -1,3 +1,5 @@ +@load base/frameworks/notice/main +@load base/utils/thresholds module SSH; @@ -76,4 +78,4 @@ event SSH::heuristic_failed_login(c: connection) $sub=fmt("%d apparently failed logins", password_rejections[id$orig_h]$n), $n=password_rejections[id$orig_h]$n]); } - } \ No newline at end of file + } diff --git a/scripts/policy/protocols/ssh/geo-data.bro b/scripts/policy/protocols/ssh/geo-data.bro index 97bd0a5803..4dfd8bbae4 100644 --- a/scripts/policy/protocols/ssh/geo-data.bro +++ b/scripts/policy/protocols/ssh/geo-data.bro @@ -1,6 +1,9 @@ ##! This implements all of the additional information and geodata detections ##! for SSH analysis. +@load base/frameworks/notice/main +@load base/protocols/ssh/main + module SSH; export { diff --git a/scripts/policy/protocols/ssh/interesting-hostnames.bro b/scripts/policy/protocols/ssh/interesting-hostnames.bro index cf6ab7e40a..c0c6262be1 100644 --- a/scripts/policy/protocols/ssh/interesting-hostnames.bro +++ b/scripts/policy/protocols/ssh/interesting-hostnames.bro @@ -1,3 +1,4 @@ +@load base/frameworks/notice/main module SSH; diff --git a/scripts/site/local-manager.bro b/scripts/site/local-manager.bro index aa28bd79da..e1e7e83a5e 100644 --- a/scripts/site/local-manager.bro +++ b/scripts/site/local-manager.bro @@ -1,5 +1,7 @@ ##! Local site policy loaded only by the manager in a cluster. +@load base/frameworks/notice/main + # If you are running a cluster you should define your Notice::policy here # so that notice processing occurs on the manager. redef Notice::policy += {