diff --git a/scripts/base/protocols/dce-rpc/__load__.bro b/scripts/base/protocols/dce-rpc/__load__.bro index 1d47f6e0cd..155b8369b8 100644 --- a/scripts/base/protocols/dce-rpc/__load__.bro +++ b/scripts/base/protocols/dce-rpc/__load__.bro @@ -1,2 +1,4 @@ @load ./consts @load ./main + +@load ./endpoint-atsvc \ No newline at end of file diff --git a/scripts/base/protocols/smb/pipe.bro b/scripts/base/protocols/dce-rpc/endpoint-atsvc.bro similarity index 54% rename from scripts/base/protocols/smb/pipe.bro rename to scripts/base/protocols/dce-rpc/endpoint-atsvc.bro index 6057c73700..88a08403d4 100644 --- a/scripts/base/protocols/smb/pipe.bro +++ b/scripts/base/protocols/dce-rpc/endpoint-atsvc.bro @@ -1,4 +1,4 @@ -module SMB; +module DCE_RPC; export { redef enum Log::ID += { @@ -16,16 +16,16 @@ export { }; } -redef record SMB::State += { - pipe_atsvc: ATSvcInfo &optional; +redef record DCE_RPC::State += { + endpoint_atsvc: ATSvcInfo &optional; }; event bro_init() &priority=5 { - Log::create_stream(ATSVC_LOG, [$columns=ATSvcInfo]); + Log::create_stream(ATSVC_LOG, [$columns=ATSvcInfo, $path="dce_rpc_atsvc"]); } -event smb_atsvc_job_add(c: connection, server: string, job: string) &priority=5 +event atsvc_job_add(c: connection, server: string, job: string) &priority=5 { local info = ATSvcInfo($ts=network_time(), $uid = c$uid, @@ -33,20 +33,20 @@ event smb_atsvc_job_add(c: connection, server: string, job: string) &priority=5 $command = "Add job", $arg = job, $server = server); - c$smb_state$pipe_atsvc = info; + c$dce_rpc_state$endpoint_atsvc = info; } -event smb_atsvc_job_id(c: connection, id: count, status: count) &priority=5 +event atsvc_job_id(c: connection, id: count, status: count) &priority=5 { - if ( c$smb_state?$pipe_atsvc ) - c$smb_state$pipe_atsvc$result = (status==0) ? "success" : "failed"; + if ( c$dce_rpc_state?$endpoint_atsvc ) + c$dce_rpc_state$endpoint_atsvc$result = (status==0) ? "success" : "failed"; } -event smb_atsvc_job_id(c: connection, id: count, status: count) &priority=-5 +event atsvc_job_id(c: connection, id: count, status: count) &priority=-5 { - if ( c$smb_state?$pipe_atsvc ) + if ( c$dce_rpc_state?$endpoint_atsvc ) { - Log::write(ATSVC_LOG, c$smb_state$pipe_atsvc); - delete c$smb_state$pipe_atsvc; + Log::write(ATSVC_LOG, c$dce_rpc_state$endpoint_atsvc); + delete c$dce_rpc_state$endpoint_atsvc; } } \ No newline at end of file diff --git a/scripts/base/protocols/smb/__load__.bro b/scripts/base/protocols/smb/__load__.bro index 0d9de8c984..34973466d2 100644 --- a/scripts/base/protocols/smb/__load__.bro +++ b/scripts/base/protocols/smb/__load__.bro @@ -2,7 +2,6 @@ @load ./const-dos-error @load ./const-nt-status @load ./main -@load ./pipe @load ./smb1-main @load ./smb2-main @load ./files