Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Added hook to filter intelligence items.

Browse source
This commit is contained in:
Jan Grashoefer 2019-03-24 21:31:48 +01:00
parent b2930a6ec3
commit 3e31f3d554
2 changed files with 16 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/base/frameworks/intel/main.bro
View file

@ -173,6 +173,14 @@ export {
## be removed.
global item_expired: hook(indicator: string, indicator_type: Type, metas: set[MetaData]);
## This hook can be used to filter intelligence items that are about to be
## inserted into the internal data store. In case the hook execution is
## terminated using break, the item will not be (re)added to the internal
## data store.
##
## item: The intel item that should be inserted.
global filter_item: hook(item: Intel::Item);
global log_intel: event(rec: Info);
}
@ -496,8 +504,11 @@ function _insert(item: Item, first_dispatch: bool &default = T)
function insert(item: Item)
{
# Insert possibly new item.
_insert(item, T);
if ( hook filter_item(item) )
{
# Insert possibly new item.
_insert(item, T);
}
}
# Function to check whether an item is present.

6
testing/btest/Baseline/scripts.base.frameworks.intel.remove-non-existing/output
View file

@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path reporter
#open 2018-02-27-17-25-30
#open 2019-03-24-20-20-10
#fields ts level message location
#types time enum string string
0.000000 Reporter::INFO Tried to remove non-existing item '192.168.1.1' (Intel::ADDR). /home/jgras/devel/bro/scripts/base/frameworks/intel/./main.bro, lines 552-553
0.000000 Reporter::INFO Tried to remove non-existing item '192.168.1.1' (Intel::ADDR). /home/jgras/devel/zeek/scripts/base/frameworks/intel/./main.bro, lines 563-564
0.000000 Reporter::INFO received termination signal (empty)
#close 2018-02-27-17-25-30
#close 2019-03-24-20-20-10