FileAnalysis: integrate w/ SMTP analyzer.

More generally w/ MIME_Mail messages, which POP3 analyzer also uses.
This commit is contained in:
Jon Siwek 2013-03-18 11:30:59 -05:00
parent 31590fbb9b
commit 550c3c477d
3 changed files with 26 additions and 1 deletions

View file

@ -1,3 +1,4 @@
@load ./main
@load ./entities
@load ./entities-excerpt
@load ./entities-excerpt
@load ./file-analysis

View file

@ -0,0 +1,18 @@
@load ./main
@load ./entities
@load base/utils/conn-ids
@load base/frameworks/file-analysis/main
module SMTP;
function get_file_handle(c: connection, is_orig: bool): string
{
if ( ! c?$smtp ) return "";
return fmt("%s smtp(%s, %s)", c$start_time, c$smtp$trans_depth,
c$smtp_state$mime_level);
}
redef FileAnalysis::handle_callbacks += {
[ANALYZER_SMTP] = get_file_handle,
};