Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Added hook to filter intelligence items.

Browse source
This commit is contained in:
Jan Grashoefer 2019-03-24 21:31:48 +01:00
parent b2930a6ec3
commit 3e31f3d554
2 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/base/frameworks/intel/main.bro
View file

@ -173,6 +173,14 @@ export {
## be removed.
global item_expired: hook(indicator: string, indicator_type: Type, metas: set[MetaData]);
## This hook can be used to filter intelligence items that are about to be
## inserted into the internal data store. In case the hook execution is
## terminated using break, the item will not be (re)added to the internal
## data store.
##
## item: The intel item that should be inserted.
global filter_item: hook(item: Intel::Item);
global log_intel: event(rec: Info);
}
@ -496,8 +504,11 @@ function _insert(item: Item, first_dispatch: bool &default = T)
function insert(item: Item)
{
# Insert possibly new item.
_insert(item, T);
if ( hook filter_item(item) )
{
# Insert possibly new item.
_insert(item, T);
}
}
# Function to check whether an item is present.