Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add page and email_admin to hostnames extension

Browse source
This commit is contained in:
Vlad Grigorescu 2021-04-23 10:05:34 -05:00
parent 672504e265
commit 3bb4a35200
3 changed files with 33 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

25
scripts/policy/frameworks/notice/extend-email/hostnames.zeek
View file

@ -1,12 +1,20 @@
##! Loading this script extends the :zeek:enum:`Notice::ACTION_EMAIL` action
##! Loading this script extends the emails that Zeek sends
##! by appending to the email the hostnames associated with
##! :zeek:type:`Notice::Info`'s *src* and *dst* fields as determined by a
##! DNS lookup.
##! DNS lookup. This is enabled for the :zeek:enum:`Notice::ACTION_EMAIL`
##! action by default, and :zeek:enum:`Notice::ACTION_EMAIL_ADMIN` and
##! :zeek:enum:`Notice::ACTION_PAGE` if their scripts are loaded.
@load base/frameworks/notice/main
module Notice;
export {
## The Notice action types whose e-mails will be extended with hostnames.
## :zeek:see:`Notice::Action`
option email_with_hostnames_types: set[Notice::Action] = {ACTION_EMAIL};
}
# We have to store references to the notices here because the when statement
# clones the frame which doesn't give us access to modify values outside
# of it's execution scope. (we get a clone of the notice instead of a
@ -19,7 +27,8 @@ hook notice(n: Notice::Info) &priority=10
return;
# This should only be done for notices that are being sent to email.
if ( ACTION_EMAIL !in n$actions )
# We calculate the intersection, and don't do anything if it's empty.
if ( |n$actions & email_with_hostnames_types| == 0 )
return;
# I'm not recovering gracefully from the when statements because I want
@ -50,3 +59,13 @@ hook notice(n: Notice::Info) &priority=10
}
}
}
# If page.zeek was loaded first, add that action
@ifdef ( ACTION_PAGE )
redef email_with_hostnames_types += { ACTION_PAGE };
@endif
# If email_admin.zeek was loaded first, add that action
@ifdef ( ACTION_EMAIL_ADMIN )
redef email_with_hostnames_types += { ACTION_EMAIL_ADMIN };
@endif