From 46d0cf517bbbfc64b31a67b7e84e999b64a010df Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@remor.com>
Date: Wed, 6 Jul 2011 09:18:22 -0400
Subject: [PATCH] Start detecting Microsoft Sharepoint servers.

---
 policy/protocols/http/software.bro | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/policy/protocols/http/software.bro b/policy/protocols/http/software.bro
index 6971026fa5..136d573f3c 100644
--- a/policy/protocols/http/software.bro
+++ b/policy/protocols/http/software.bro
@@ -49,5 +49,10 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
 			Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_SERVER));
 		else if ( name == "X-POWERED-BY" )
 			Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_APPSERVER));
+		else if ( name == "MICROSOFTSHAREPOINTTEAMSERVICES" )
+			{
+			value = cat("SharePoint/", value);
+			Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_APPSERVER));
+			}
 		}
 	}
\ No newline at end of file