Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

scripts/analyzer: Introduce Analyzer::requested_analyzers

Browse source 
In certain deployment scenarios, all analyzers are disabled by default.
However, conditionally/optionally loaded scripts may rely on analyzers
functioning and declare a request for them.

Add a global set set to the Analyzer module where external scripts can record
their requirement/request for a certain analyzer. Analyzers found in this
set are enabled at zeek_init() time.
This commit is contained in:
Arne Welzel 2022-10-26 18:48:01 +02:00
parent 061c066a51
commit 4e75d54d49
5 changed files with 95 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
testing/btest/scripts/base/frameworks/analyzer/request-analyzer.zeek Normal file
View file

@ -0,0 +1,16 @@
# @TEST-DOC: Ensure only the HTTP analyzer is enabled (filter out some noise from the trace)
# @TEST-EXEC: zeek -b -f 'port 53 or port 80' -r ${TRACES}/wikipedia.trace %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: test ! -f dns.log
@load base/protocols/conn
@load base/protocols/dns
@load base/protocols/http
# Turn all analyzers off.
redef Analyzer::disable_all = T;
redef Analyzer::requested_analyzers += {
Analyzer::ANALYZER_HTTP,
};