mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Document which Bro script vars are set by BroControl
This commit is contained in:
parent
1b26c05c2c
commit
4b8171f74a
6 changed files with 28 additions and 4 deletions
|
@ -120,6 +120,7 @@ export {
|
|||
## The cluster layout definition. This should be placed into a filter
|
||||
## named cluster-layout.bro somewhere in the BROPATH. It will be
|
||||
## automatically loaded if the CLUSTER_NODE environment variable is set.
|
||||
## Note that BroControl handles all of this automatically.
|
||||
const nodes: table[string] of Node = {} &redef;
|
||||
|
||||
## This is usually supplied on the command line for each instance
|
||||
|
|
|
@ -15,13 +15,16 @@ export {
|
|||
## are wildcards.
|
||||
const listen_interface = 0.0.0.0 &redef;
|
||||
|
||||
## Which port to listen on.
|
||||
## Which port to listen on. Note that BroControl sets this
|
||||
## automatically.
|
||||
const listen_port = 47757/tcp &redef;
|
||||
|
||||
## This defines if a listening socket should use SSL.
|
||||
const listen_ssl = F &redef;
|
||||
|
||||
## Defines if a listening socket can bind to IPv6 addresses.
|
||||
##
|
||||
## Note that this is overridden by the BroControl IPv6Comm option.
|
||||
const listen_ipv6 = F &redef;
|
||||
|
||||
## If :bro:id:`Communication::listen_interface` is a non-global
|
||||
|
@ -128,7 +131,8 @@ export {
|
|||
};
|
||||
|
||||
## The table of Bro or Broccoli nodes that Bro will initiate connections
|
||||
## to or respond to connections from.
|
||||
## to or respond to connections from. Note that BroControl sets this
|
||||
## automatically.
|
||||
global nodes: table[string] of Node &redef;
|
||||
|
||||
## A table of peer nodes for which this node issued a
|
||||
|
|
|
@ -76,9 +76,16 @@ export {
|
|||
};
|
||||
|
||||
## Default rotation interval. Zero disables rotation.
|
||||
##
|
||||
## Note that this is overridden by the BroControl LogRotationInterval
|
||||
## option.
|
||||
const default_rotation_interval = 0secs &redef;
|
||||
|
||||
## Default alarm summary mail interval. Zero disables alarm summary mails.
|
||||
## Default alarm summary mail interval. Zero disables alarm summary
|
||||
## mails.
|
||||
##
|
||||
## Note that this is overridden by the BroControl MailAlarmsInterval
|
||||
## option.
|
||||
const default_mail_alarms_interval = 0secs &redef;
|
||||
|
||||
## Default naming format for timestamps embedded into filenames.
|
||||
|
|
|
@ -13,6 +13,8 @@ export {
|
|||
|
||||
## Address to send the pretty-printed reports to. Default if not set is
|
||||
## :bro:id:`Notice::mail_dest`.
|
||||
##
|
||||
## Note that this is overridden by the BroControl MailAlarmsTo option.
|
||||
const mail_dest_pretty_printed = "" &redef;
|
||||
## If an address from one of these networks is reported, we mark
|
||||
## the entry with an additional quote symbol (i.e., ">"). Many MUAs
|
||||
|
|
|
@ -182,17 +182,26 @@ export {
|
|||
global policy: hook(n: Notice::Info);
|
||||
|
||||
## Local system sendmail program.
|
||||
##
|
||||
## Note that this is overridden by the BroControl SendMail option.
|
||||
const sendmail = "/usr/sbin/sendmail" &redef;
|
||||
## Email address to send notices with the
|
||||
## :bro:enum:`Notice::ACTION_EMAIL` action or to send bulk alarm logs
|
||||
## on rotation with :bro:enum:`Notice::ACTION_ALARM`.
|
||||
##
|
||||
## Note that this is overridden by the BroControl MailTo option.
|
||||
const mail_dest = "" &redef;
|
||||
|
||||
## Address that emails will be from.
|
||||
##
|
||||
## Note that this is overridden by the BroControl MailFrom option.
|
||||
const mail_from = "Big Brother <bro@localhost>" &redef;
|
||||
## Reply-to address used in outbound email.
|
||||
const reply_to = "" &redef;
|
||||
## Text string prefixed to the subject of all emails sent out.
|
||||
##
|
||||
## Note that this is overridden by the BroControl MailSubjectPrefix
|
||||
## option.
|
||||
const mail_subject_prefix = "[Bro]" &redef;
|
||||
## The maximum amount of time a plugin can delay email from being sent.
|
||||
const max_email_delay = 15secs &redef;
|
||||
|
|
|
@ -17,7 +17,8 @@ export {
|
|||
[::1]/128,
|
||||
} &redef;
|
||||
|
||||
## Networks that are considered "local".
|
||||
## Networks that are considered "local". Note that BroControl sets
|
||||
## this automatically.
|
||||
const local_nets: set[subnet] &redef;
|
||||
|
||||
## This is used for retrieving the subnet when using multiple entries in
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue