Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Improve Intel expire-item btest to be less time-sensitive

Browse source
This commit is contained in:
Jon Siwek 2020-08-07 16:10:37 -07:00 • committed by Tim Wojtulewicz
parent af2262ddff
commit 3ad306355f
2 changed files with 59 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

29
testing/btest/Baseline/scripts.base.frameworks.intel.expire-item/output
View file

@ -3,32 +3,25 @@
#empty_field (empty)
#unset_field -
#path intel
#open 2020-07-06-20-13-06
#open 2020-08-07-23-04-27
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc
#types time string addr port addr port string enum enum string set[enum] set[string] string string string
1594066386.095894 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - -
1594066389.097925 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - -
1594066392.099402 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - -
1594066395.103419 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - -
1594066398.103542 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - -
#close 2020-07-06-20-13-21
1596841467.743662 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - -
1596841470.744058 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - -
1596841476.155569 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - -
#close 2020-08-07-23-04-40
-- Run 1 --
Trigger: 1.2.3.4
Seen: 1.2.3.4
Match: 1.2.3.4
-- Run 2 --
Trigger: 1.2.3.4
Reinsert: 1.2.3.4
Seen: 1.2.3.4
-- Run 3 --
Trigger: 1.2.3.4
Seen: 1.2.3.4
Match: 1.2.3.4
Expired: 192.168.0.0/16
-- Run 3 --
Seen: 1.2.3.4
Match: 1.2.3.4
Expired: 1.2.3.4 (took longer: T)
-- Run 4 --
Trigger: 1.2.3.4
Seen: 1.2.3.4
-- Run 5 --
Trigger: 1.2.3.4
Seen: 1.2.3.4
Expired: 1.2.3.4
-- Run 6 --
Trigger: 1.2.3.4