Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'master' into topic/jsiwek/supervisor

Browse source
This commit is contained in:
Jon Siwek 2020-01-07 14:55:51 -08:00
commit 6046da9993
314 changed files with 3709 additions and 5389 deletions
Download patch file Download diff file Expand all files Collapse all files

33
scripts/base/init-bare.zeek
View file

@ -120,6 +120,22 @@ type mime_match: record {
## :zeek:see:`file_magic`
type mime_matches: vector of mime_match;
## Properties of an I/O packet source being read by Zeek.
type PacketSource: record {
## Whether the packet source is a live interface or offline pcap file.
live: bool;
## The interface name for a live interface or filesystem path of
## an offline pcap file.
path: string;
## The data link-layer type of the packet source.
link_type: int;
## The netmask assoicated with the source or ``NETMASK_UNKNOWN``.
netmask: count;
};
## A list of packet sources being read by Zeek.
type PacketSourceList: vector of PacketSource;
## A connection's transport-layer protocol. Note that Zeek uses the term
## "connection" broadly, using flow semantics for ICMP and UDP.
type transport_proto: enum {
@ -419,6 +435,11 @@ type connection: record {
## The inner VLAN, if applicable for this connection.
inner_vlan: int &optional;
## Flag that will be true if :zeek:see:`connection_successful` has
## already been generated for the connection. See the documentation of
## that event for a definition of what makes a connection "succesful".
successful: bool;
};
## Default amount of time a file can be inactive before the file analysis
@ -2581,7 +2602,7 @@ export {
negotiate_lm_key : bool;
## If set, requests connectionless authentication
negotiate_datagram : bool;
## If set, requests session key negotiation for message
## If set, requests session key negotiation for message
## confidentiality
negotiate_seal : bool;
## If set, requests session key negotiation for message
@ -2769,7 +2790,7 @@ export {
## The server supports compressed data transfer. Requires bulk_transfer.
## Note: No known implementations support this
compressed_data : bool;
## The server supports extended security exchanges
## The server supports extended security exchanges
extended_security : bool;
};
@ -2862,7 +2883,7 @@ export {
};
type SMB1::NegotiateResponse: record {
## If the server does not understand any of the dialect strings, or if
## If the server does not understand any of the dialect strings, or if
## PC NETWORK PROGRAM 1.0 is the chosen dialect.
core : SMB1::NegotiateResponseCore &optional;
## If the chosen dialect is greater than core up to and including
@ -2913,7 +2934,7 @@ export {
## If challenge/response auth is not being used, this is the password.
## Otherwise, it's the response to the server's challenge.
## Note: Only set for pre NT LM 0.12
account_password : string &optional;
account_password : string &optional;
## Client's primary domain, if known
## Note: not set for NT LM 0.12 with extended security
primary_domain : string &optional;
@ -2931,7 +2952,7 @@ export {
## Note: only set for NT LM 0.12
capabilities : SMB1::SessionSetupAndXCapabilities &optional;
};
type SMB1::SessionSetupAndXResponse: record {
## Count of parameter words (should be 3 for pre NT LM 0.12 and 4 for NT LM 0.12)
word_count : count;
@ -3996,7 +4017,7 @@ type bt_tracker_headers: table[string] of string;
## for a range of modbus coils.
type ModbusCoils: vector of bool;
## A vector of count values that represent 16bit modbus
## A vector of count values that represent 16bit modbus
## register values.
type ModbusRegisters: vector of count;