mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
Remove broxygen Sphinx integration
The broxygen-generated files now live in the git repo, have tests that check that they are up-to-date, and a script to re-generate them on-demand.
This commit is contained in:
Jon Siwek
parent
9e5e9d04b7
commit
7e9d48f532
549 changed files with 89909 additions and 100 deletions
113
doc/scripts/base/bif/plugins/Bro_ARP.events.bif.bro.rst
Normal file
113
doc/scripts/base/bif/plugins/Bro_ARP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,113 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_ARP.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================== ====================================================
|
||||
:bro:id:`arp_reply`: :bro:type:`event` Generated for ARP replies.
|
||||
:bro:id:`arp_request`: :bro:type:`event` Generated for ARP requests.
|
||||
:bro:id:`bad_arp`: :bro:type:`event` Generated for ARP packets that Bro cannot interpret.
|
||||
======================================== ====================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: arp_reply
|
||||
|
||||
:Type: :bro:type:`event` (mac_src: :bro:type:`string`, mac_dst: :bro:type:`string`, SPA: :bro:type:`addr`, SHA: :bro:type:`string`, TPA: :bro:type:`addr`, THA: :bro:type:`string`)
|
||||
|
||||
Generated for ARP replies.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Address_Resolution_Protocol>`__
|
||||
for more information about the ARP protocol.
|
||||
|
||||
|
||||
:mac_src: The reply's source MAC address.
|
||||
|
||||
|
||||
:mac_dst: The reply's destination MAC address.
|
||||
|
||||
|
||||
:SPA: The sender protocol address.
|
||||
|
||||
|
||||
:SHA: The sender hardware address.
|
||||
|
||||
|
||||
:TPA: The target protocol address.
|
||||
|
||||
|
||||
:THA: The target hardware address.
|
||||
|
||||
.. bro:see:: arp_request bad_arp
|
||||
|
||||
.. bro:id:: arp_request
|
||||
|
||||
:Type: :bro:type:`event` (mac_src: :bro:type:`string`, mac_dst: :bro:type:`string`, SPA: :bro:type:`addr`, SHA: :bro:type:`string`, TPA: :bro:type:`addr`, THA: :bro:type:`string`)
|
||||
|
||||
Generated for ARP requests.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Address_Resolution_Protocol>`__
|
||||
for more information about the ARP protocol.
|
||||
|
||||
|
||||
:mac_src: The request's source MAC address.
|
||||
|
||||
|
||||
:mac_dst: The request's destination MAC address.
|
||||
|
||||
|
||||
:SPA: The sender protocol address.
|
||||
|
||||
|
||||
:SHA: The sender hardware address.
|
||||
|
||||
|
||||
:TPA: The target protocol address.
|
||||
|
||||
|
||||
:THA: The target hardware address.
|
||||
|
||||
.. bro:see:: arp_reply bad_arp
|
||||
|
||||
.. bro:id:: bad_arp
|
||||
|
||||
:Type: :bro:type:`event` (SPA: :bro:type:`addr`, SHA: :bro:type:`string`, TPA: :bro:type:`addr`, THA: :bro:type:`string`, explanation: :bro:type:`string`)
|
||||
|
||||
Generated for ARP packets that Bro cannot interpret. Examples are packets
|
||||
with non-standard hardware address formats or hardware addresses that do not
|
||||
match the originator of the packet.
|
||||
|
||||
|
||||
:SPA: The sender protocol address.
|
||||
|
||||
|
||||
:SHA: The sender hardware address.
|
||||
|
||||
|
||||
:TPA: The target protocol address.
|
||||
|
||||
|
||||
:THA: The target hardware address.
|
||||
|
||||
|
||||
:explanation: A short description of why the ARP packet is considered "bad".
|
||||
|
||||
.. bro:see:: arp_reply arp_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_AsciiReader.ascii.bif.bro
|
||||
==============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: InputAscii
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, InputAscii
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_AsciiWriter.ascii.bif.bro
|
||||
==============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: LogAscii
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, LogAscii
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
99
doc/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro.rst
Normal file
99
doc/scripts/base/bif/plugins/Bro_BackDoor.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_BackDoor.events.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================= ===========
|
||||
:bro:id:`backdoor_remove_conn`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`backdoor_stats`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`ftp_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`gnutella_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`http_proxy_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`http_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`irc_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`rlogin_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`smtp_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`ssh_signature_found`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`telnet_signature_found`: :bro:type:`event` Deprecated.
|
||||
======================================================= ===========
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: backdoor_remove_conn
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: backdoor_stats
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, os: :bro:type:`backdoor_endp_stats`, rs: :bro:type:`backdoor_endp_stats`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: ftp_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: gnutella_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: http_proxy_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: http_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: irc_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: rlogin_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, num_null: :bro:type:`count`, len: :bro:type:`count`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: smtp_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: ssh_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: telnet_signature_found
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, len: :bro:type:`count`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_BenchmarkReader.benchmark.bif.bro
|
||||
======================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: InputBenchmark
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, InputBenchmark
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_BinaryReader.binary.bif.bro
|
||||
================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: InputBinary
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, InputBinary
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
310
doc/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro.rst
Normal file
310
doc/scripts/base/bif/plugins/Bro_BitTorrent.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,310 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_BitTorrent.events.bif.bro
|
||||
==============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=========================================================== =====
|
||||
:bro:id:`bittorrent_peer_bitfield`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_cancel`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_choke`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_handshake`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_have`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_interested`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_keep_alive`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_not_interested`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_piece`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_port`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_request`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_unchoke`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_unknown`: :bro:type:`event` TODO.
|
||||
:bro:id:`bittorrent_peer_weird`: :bro:type:`event` TODO.
|
||||
:bro:id:`bt_tracker_request`: :bro:type:`event` TODO.
|
||||
:bro:id:`bt_tracker_response`: :bro:type:`event` TODO.
|
||||
:bro:id:`bt_tracker_response_not_ok`: :bro:type:`event` TODO.
|
||||
:bro:id:`bt_tracker_weird`: :bro:type:`event` TODO.
|
||||
=========================================================== =====
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: bittorrent_peer_bitfield
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, bitfield: :bro:type:`string`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_cancel bittorrent_peer_choke bittorrent_peer_handshake
|
||||
bittorrent_peer_have bittorrent_peer_interested bittorrent_peer_keep_alive
|
||||
bittorrent_peer_not_interested bittorrent_peer_piece bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_cancel
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, index: :bro:type:`count`, begin: :bro:type:`count`, length: :bro:type:`count`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_choke
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_handshake
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, reserved: :bro:type:`string`, info_hash: :bro:type:`string`, peer_id: :bro:type:`string`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_have bittorrent_peer_interested bittorrent_peer_keep_alive
|
||||
bittorrent_peer_not_interested bittorrent_peer_piece bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_have
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, piece_index: :bro:type:`count`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_interested bittorrent_peer_keep_alive
|
||||
bittorrent_peer_not_interested bittorrent_peer_piece bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_interested
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_keep_alive
|
||||
bittorrent_peer_not_interested bittorrent_peer_piece bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_keep_alive
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_not_interested bittorrent_peer_piece bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_not_interested
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_piece bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_piece
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, index: :bro:type:`count`, begin: :bro:type:`count`, piece_length: :bro:type:`count`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_port
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_port
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, listen_port: :bro:type:`port`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_request bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, index: :bro:type:`count`, begin: :bro:type:`count`, length: :bro:type:`count`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_unchoke bittorrent_peer_unknown
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_unchoke
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_unknown
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, message_id: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bittorrent_peer_weird
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`string`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown
|
||||
|
||||
.. bro:id:: bt_tracker_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, uri: :bro:type:`string`, headers: :bro:type:`bt_tracker_headers`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bt_tracker_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, status: :bro:type:`count`, headers: :bro:type:`bt_tracker_headers`, peers: :bro:type:`bittorrent_peer_set`, benc: :bro:type:`bittorrent_benc_dir`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bt_tracker_response_not_ok
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, status: :bro:type:`count`, headers: :bro:type:`bt_tracker_headers`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
.. bro:id:: bt_tracker_weird
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`string`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/BitTorrent_(protocol)>`__ for
|
||||
more information about the BitTorrent protocol.
|
||||
|
||||
.. bro:see:: bittorrent_peer_bitfield bittorrent_peer_cancel bittorrent_peer_choke
|
||||
bittorrent_peer_handshake bittorrent_peer_have bittorrent_peer_interested
|
||||
bittorrent_peer_keep_alive bittorrent_peer_not_interested bittorrent_peer_piece
|
||||
bittorrent_peer_port bittorrent_peer_request bittorrent_peer_unchoke
|
||||
bittorrent_peer_unknown bittorrent_peer_weird
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_ConfigReader.config.bif.bro
|
||||
================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: InputConfig
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, InputConfig
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
64
doc/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro.rst
Normal file
64
doc/scripts/base/bif/plugins/Bro_ConnSize.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_ConnSize.events.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=========================================================== ===============================================================
|
||||
:bro:id:`conn_bytes_threshold_crossed`: :bro:type:`event` Generated for a connection that crossed a set byte threshold.
|
||||
:bro:id:`conn_packets_threshold_crossed`: :bro:type:`event` Generated for a connection that crossed a set packet threshold.
|
||||
=========================================================== ===============================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: conn_bytes_threshold_crossed
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for a connection that crossed a set byte threshold. Note that this
|
||||
is a low level event that should usually be avoided for user code. Use
|
||||
ConnThreshold::bytes_threshold_crossed instead.
|
||||
|
||||
|
||||
:c: the connection
|
||||
|
||||
|
||||
:threshold: the threshold that was set
|
||||
|
||||
|
||||
:is_orig: true if the threshold was crossed by the originator of the connection
|
||||
|
||||
.. bro:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_packets_threshold_crossed
|
||||
get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||
|
||||
.. bro:id:: conn_packets_threshold_crossed
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for a connection that crossed a set packet threshold. Note that this
|
||||
is a low level event that should usually be avoided for user code. Use
|
||||
ConnThreshold::bytes_threshold_crossed instead.
|
||||
|
||||
|
||||
:c: the connection
|
||||
|
||||
|
||||
:threshold: the threshold that was set
|
||||
|
||||
|
||||
:is_orig: true if the threshold was crossed by the originator of the connection
|
||||
|
||||
.. bro:see:: set_current_conn_packets_threshold set_current_conn_bytes_threshold conn_bytes_threshold_crossed
|
||||
get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||
|
||||
|
||||
103
doc/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro.rst
Normal file
103
doc/scripts/base/bif/plugins/Bro_ConnSize.functions.bif.bro.rst
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_ConnSize.functions.bif.bro
|
||||
===============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
================================================================== ===================================================================================
|
||||
:bro:id:`get_current_conn_bytes_threshold`: :bro:type:`function` Gets the current byte threshold size for a connection.
|
||||
:bro:id:`get_current_conn_packets_threshold`: :bro:type:`function` Gets the current packet threshold size for a connection.
|
||||
:bro:id:`set_current_conn_bytes_threshold`: :bro:type:`function` Sets the current byte threshold for connection sizes, overwriting any potential old
|
||||
threshold.
|
||||
:bro:id:`set_current_conn_packets_threshold`: :bro:type:`function` Sets a threshold for connection packets, overwtiting any potential old thresholds.
|
||||
================================================================== ===================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: get_current_conn_bytes_threshold
|
||||
|
||||
:Type: :bro:type:`function` (cid: :bro:type:`conn_id`, is_orig: :bro:type:`bool`) : :bro:type:`count`
|
||||
|
||||
Gets the current byte threshold size for a connection.
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:is_orig: If true, threshold of originator, otherwhise threshold of responder.
|
||||
|
||||
|
||||
:returns: 0 if no threshold is set or the threshold in bytes
|
||||
|
||||
.. bro:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||
get_current_conn_packets_threshold
|
||||
|
||||
.. bro:id:: get_current_conn_packets_threshold
|
||||
|
||||
:Type: :bro:type:`function` (cid: :bro:type:`conn_id`, is_orig: :bro:type:`bool`) : :bro:type:`count`
|
||||
|
||||
Gets the current packet threshold size for a connection.
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:is_orig: If true, threshold of originator, otherwhise threshold of responder.
|
||||
|
||||
|
||||
:returns: 0 if no threshold is set or the threshold in packets
|
||||
|
||||
.. bro:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||
get_current_conn_bytes_threshold
|
||||
|
||||
.. bro:id:: set_current_conn_bytes_threshold
|
||||
|
||||
:Type: :bro:type:`function` (cid: :bro:type:`conn_id`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`) : :bro:type:`bool`
|
||||
|
||||
Sets the current byte threshold for connection sizes, overwriting any potential old
|
||||
threshold. Be aware that in nearly any case you will want to use the high level API
|
||||
instead (ConnThreshold::set_bytes_threshold).
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:threshold: Threshold in bytes.
|
||||
|
||||
|
||||
:is_orig: If true, threshold is set for bytes from originator, otherwhise for bytes from responder.
|
||||
|
||||
.. bro:see:: set_current_conn_packets_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||
get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||
|
||||
.. bro:id:: set_current_conn_packets_threshold
|
||||
|
||||
:Type: :bro:type:`function` (cid: :bro:type:`conn_id`, threshold: :bro:type:`count`, is_orig: :bro:type:`bool`) : :bro:type:`bool`
|
||||
|
||||
Sets a threshold for connection packets, overwtiting any potential old thresholds.
|
||||
Be aware that in nearly any case you will want to use the high level API
|
||||
instead (ConnThreshold::set_packets_threshold).
|
||||
|
||||
|
||||
:cid: The connection id.
|
||||
|
||||
|
||||
:threshold: Threshold in packets.
|
||||
|
||||
|
||||
:is_orig: If true, threshold is set for packets from originator, otherwhise for packets from responder.
|
||||
|
||||
.. bro:see:: set_current_conn_bytes_threshold conn_bytes_threshold_crossed conn_packets_threshold_crossed
|
||||
get_current_conn_bytes_threshold get_current_conn_packets_threshold
|
||||
|
||||
|
||||
15
doc/scripts/base/bif/plugins/Bro_DCE_RPC.consts.bif.bro.rst
Normal file
15
doc/scripts/base/bif/plugins/Bro_DCE_RPC.consts.bif.bro.rst
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DCE_RPC.consts.bif.bro
|
||||
===========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
198
doc/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro.rst
Normal file
198
doc/scripts/base/bif/plugins/Bro_DCE_RPC.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,198 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DCE_RPC.events.bif.bro
|
||||
===========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================= ==============================================================================================================================
|
||||
:bro:id:`dce_rpc_alter_context`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` alter context request message.
|
||||
:bro:id:`dce_rpc_alter_context_resp`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` alter context response message.
|
||||
:bro:id:`dce_rpc_bind`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` bind request message.
|
||||
:bro:id:`dce_rpc_bind_ack`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` bind request ack message.
|
||||
:bro:id:`dce_rpc_message`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` message.
|
||||
:bro:id:`dce_rpc_request`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` request message.
|
||||
:bro:id:`dce_rpc_response`: :bro:type:`event` Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` response message.
|
||||
======================================================= ==============================================================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: dce_rpc_alter_context
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, fid: :bro:type:`count`, ctx_id: :bro:type:`count`, uuid: :bro:type:`string`, ver_major: :bro:type:`count`, ver_minor: :bro:type:`count`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` alter context request message.
|
||||
Since RPC offers the ability for a client to request connections to multiple endpoints, this event can occur
|
||||
multiple times for a single RPC message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
|
||||
:ctx_id: The context identifier of the data representation.
|
||||
|
||||
|
||||
:uuid: The string interpretted uuid of the endpoint being requested.
|
||||
|
||||
|
||||
:ver_major: The major version of the endpoint being requested.
|
||||
|
||||
|
||||
:ver_minor: The minor version of the endpoint being requested.
|
||||
|
||||
.. bro:see:: dce_rpc_message dce_rpc_bind dce_rpc_bind_ack dce_rpc_request dce_rpc_response dce_rpc_alter_context_resp
|
||||
|
||||
.. bro:id:: dce_rpc_alter_context_resp
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, fid: :bro:type:`count`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` alter context response message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
.. bro:see:: dce_rpc_message dce_rpc_bind dce_rpc_bind_ack dce_rpc_request dce_rpc_response dce_rpc_alter_context
|
||||
|
||||
.. bro:id:: dce_rpc_bind
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, fid: :bro:type:`count`, ctx_id: :bro:type:`count`, uuid: :bro:type:`string`, ver_major: :bro:type:`count`, ver_minor: :bro:type:`count`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` bind request message.
|
||||
Since RPC offers the ability for a client to request connections to multiple endpoints, this event can occur
|
||||
multiple times for a single RPC message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
|
||||
:ctx_id: The context identifier of the data representation.
|
||||
|
||||
|
||||
:uuid: The string interpretted uuid of the endpoint being requested.
|
||||
|
||||
|
||||
:ver_major: The major version of the endpoint being requested.
|
||||
|
||||
|
||||
:ver_minor: The minor version of the endpoint being requested.
|
||||
|
||||
.. bro:see:: dce_rpc_message dce_rpc_bind_ack dce_rpc_request dce_rpc_response
|
||||
|
||||
.. bro:id:: dce_rpc_bind_ack
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, fid: :bro:type:`count`, sec_addr: :bro:type:`string`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` bind request ack message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
|
||||
:sec_addr: Secondary address for the ack.
|
||||
|
||||
.. bro:see:: dce_rpc_message dce_rpc_bind dce_rpc_request dce_rpc_response
|
||||
|
||||
.. bro:id:: dce_rpc_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, fid: :bro:type:`count`, ptype_id: :bro:type:`count`, ptype: :bro:type:`DCE_RPC::PType`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the message was sent by the originator of the TCP connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
|
||||
:ptype_id: Numeric representation of the procedure type of the message.
|
||||
|
||||
|
||||
:ptype: Enum representation of the prodecure type of the message.
|
||||
|
||||
.. bro:see:: dce_rpc_bind dce_rpc_bind_ack dce_rpc_request dce_rpc_response
|
||||
|
||||
.. bro:id:: dce_rpc_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, fid: :bro:type:`count`, ctx_id: :bro:type:`count`, opnum: :bro:type:`count`, stub_len: :bro:type:`count`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` request message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
|
||||
:ctx_id: The context identifier of the data representation.
|
||||
|
||||
|
||||
:opnum: Number of the RPC operation.
|
||||
|
||||
|
||||
:stub_len: Length of the data for the request.
|
||||
|
||||
.. bro:see:: dce_rpc_message dce_rpc_bind dce_rpc_bind_ack dce_rpc_response
|
||||
|
||||
.. bro:id:: dce_rpc_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, fid: :bro:type:`count`, ctx_id: :bro:type:`count`, opnum: :bro:type:`count`, stub_len: :bro:type:`count`)
|
||||
|
||||
Generated for every :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` response message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:fid: File ID of the PIPE that carried the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)`
|
||||
message. Zero will be used if the :abbr:`DCE-RPC (Distributed Computing Environment/Remote Procedure Calls)` was
|
||||
not transported over a pipe.
|
||||
|
||||
|
||||
:ctx_id: The context identifier of the data representation.
|
||||
|
||||
:opnum: Number of the RPC operation.
|
||||
|
||||
|
||||
:stub_len: Length of the data for the response.
|
||||
|
||||
.. bro:see:: dce_rpc_message dce_rpc_bind dce_rpc_bind_ack dce_rpc_request
|
||||
|
||||
|
||||
105
doc/scripts/base/bif/plugins/Bro_DCE_RPC.types.bif.bro.rst
Normal file
105
doc/scripts/base/bif/plugins/Bro_DCE_RPC.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DCE_RPC.types.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: DCE_RPC
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespaces: DCE_RPC, GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Types
|
||||
#####
|
||||
============================================ =
|
||||
:bro:type:`DCE_RPC::IfID`: :bro:type:`enum`
|
||||
:bro:type:`DCE_RPC::PType`: :bro:type:`enum`
|
||||
============================================ =
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Types
|
||||
#####
|
||||
.. bro:type:: DCE_RPC::IfID
|
||||
|
||||
:Type: :bro:type:`enum`
|
||||
|
||||
.. bro:enum:: DCE_RPC::unknown_if DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::epmapper DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::lsarpc DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::lsa_ds DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::mgmt DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::netlogon DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::samr DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::srvsvc DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::spoolss DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::drs DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::winspipe DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::wkssvc DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::oxid DCE_RPC::IfID
|
||||
|
||||
.. bro:enum:: DCE_RPC::ISCMActivator DCE_RPC::IfID
|
||||
|
||||
|
||||
.. bro:type:: DCE_RPC::PType
|
||||
|
||||
:Type: :bro:type:`enum`
|
||||
|
||||
.. bro:enum:: DCE_RPC::REQUEST DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::PING DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::RESPONSE DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::FAULT DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::WORKING DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::NOCALL DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::REJECT DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::ACK DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::CL_CANCEL DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::FACK DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::CANCEL_ACK DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::BIND DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::BIND_ACK DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::BIND_NAK DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::ALTER_CONTEXT DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::ALTER_CONTEXT_RESP DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::AUTH3 DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::SHUTDOWN DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::CO_CANCEL DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::ORPHANED DCE_RPC::PType
|
||||
|
||||
.. bro:enum:: DCE_RPC::RTS DCE_RPC::PType
|
||||
|
||||
|
||||
|
||||
43
doc/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro.rst
Normal file
43
doc/scripts/base/bif/plugins/Bro_DHCP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DHCP.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================= ================================
|
||||
:bro:id:`dhcp_message`: :bro:type:`event` Generated for all DHCP messages.
|
||||
========================================= ================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: dhcp_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`DHCP::Msg`, options: :bro:type:`DHCP::Options`)
|
||||
|
||||
Generated for all DHCP messages.
|
||||
|
||||
|
||||
:c: The connection record describing the underlying UDP flow.
|
||||
|
||||
|
||||
:is_orig: Indicate if the message came in a packet from the
|
||||
originator/client of the udp flow or the responder/server.
|
||||
|
||||
|
||||
:msg: The parsed type-independent part of the DHCP message. The message
|
||||
type is indicated in this record.
|
||||
|
||||
|
||||
:options: The full set of supported and parsed DHCP options.
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_DHCP.types.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_DHCP.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DHCP.types.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: DHCP
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespaces: DHCP, GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
567
doc/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro.rst
Normal file
567
doc/scripts/base/bif/plugins/Bro_DNP3.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,567 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DNP3.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================================== ===========================================================================
|
||||
:bro:id:`dnp3_analog_input_16wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 30 and variation number 2
|
||||
analog input 16 bit with flag
|
||||
:bro:id:`dnp3_analog_input_16woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 30 and variation number 4
|
||||
analog input 16 bit without flag
|
||||
:bro:id:`dnp3_analog_input_32wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 30 and variation number 1
|
||||
analog input 32 bit with flag
|
||||
:bro:id:`dnp3_analog_input_32woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 30 and variation number 3
|
||||
analog input 32 bit without flag
|
||||
:bro:id:`dnp3_analog_input_DPwFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 30 and variation number 6
|
||||
analog input double precision, float point with flag
|
||||
:bro:id:`dnp3_analog_input_SPwFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 30 and variation number 5
|
||||
analog input single precision, float point with flag
|
||||
:bro:id:`dnp3_analog_input_event_16wTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 4
|
||||
analog input event 16 bit with time
|
||||
:bro:id:`dnp3_analog_input_event_16woTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 2
|
||||
analog input event 16 bit without time
|
||||
:bro:id:`dnp3_analog_input_event_32wTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 3
|
||||
analog input event 32 bit with time
|
||||
:bro:id:`dnp3_analog_input_event_32woTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 1
|
||||
analog input event 32 bit without time
|
||||
:bro:id:`dnp3_analog_input_event_DPwTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 8
|
||||
analog input event double-precisiion float point with time
|
||||
:bro:id:`dnp3_analog_input_event_DPwoTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 6
|
||||
analog input event double-precision float point without time
|
||||
:bro:id:`dnp3_analog_input_event_SPwTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 7
|
||||
analog input event single-precision float point with time
|
||||
:bro:id:`dnp3_analog_input_event_SPwoTime`: :bro:type:`event` Generated for DNP3 objects with the group number 32 and variation number 5
|
||||
analog input event single-precision float point without time
|
||||
:bro:id:`dnp3_application_request_header`: :bro:type:`event` Generated for a DNP3 request header.
|
||||
:bro:id:`dnp3_application_response_header`: :bro:type:`event` Generated for a DNP3 response header.
|
||||
:bro:id:`dnp3_attribute_common`: :bro:type:`event` Generated for DNP3 attributes.
|
||||
:bro:id:`dnp3_counter_16wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 20 and variation number 2
|
||||
counter 16 bit with flag
|
||||
:bro:id:`dnp3_counter_16woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 20 and variation number 6
|
||||
counter 16 bit without flag
|
||||
:bro:id:`dnp3_counter_32wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 20 and variation number 1
|
||||
counter 32 bit with flag
|
||||
:bro:id:`dnp3_counter_32woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 20 and variation number 5
|
||||
counter 32 bit without flag
|
||||
:bro:id:`dnp3_crob`: :bro:type:`event` Generated for DNP3 objects with the group number 12 and variation number 1
|
||||
CROB: control relay output block
|
||||
:bro:id:`dnp3_debug_byte`: :bro:type:`event` Debugging event generated by the DNP3 analyzer.
|
||||
:bro:id:`dnp3_file_transport`: :bro:type:`event` g70
|
||||
:bro:id:`dnp3_frozen_analog_input_16wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 2
|
||||
frozen analog input 16 bit with flag
|
||||
:bro:id:`dnp3_frozen_analog_input_16wTime`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 4
|
||||
frozen analog input 16 bit with time-of-freeze
|
||||
:bro:id:`dnp3_frozen_analog_input_16woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 6
|
||||
frozen analog input 16 bit without flag
|
||||
:bro:id:`dnp3_frozen_analog_input_32wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 1
|
||||
frozen analog input 32 bit with flag
|
||||
:bro:id:`dnp3_frozen_analog_input_32wTime`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 3
|
||||
frozen analog input 32 bit with time-of-freeze
|
||||
:bro:id:`dnp3_frozen_analog_input_32woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 5
|
||||
frozen analog input 32 bit without flag
|
||||
:bro:id:`dnp3_frozen_analog_input_DPwFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 8
|
||||
frozen analog input double-precision, float point with flag
|
||||
:bro:id:`dnp3_frozen_analog_input_SPwFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 31 and variation number 7
|
||||
frozen analog input single-precision, float point with flag
|
||||
:bro:id:`dnp3_frozen_analog_input_event_16wTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 4
|
||||
frozen analog input event 16 bit with time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_16woTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 2
|
||||
frozen analog input event 16 bit without time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_32wTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 3
|
||||
frozen analog input event 32 bit with time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_32woTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 1
|
||||
frozen analog input event 32 bit without time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_DPwTime`: :bro:type:`event` Generated for DNP3 objects with the group number 34 and variation number 8
|
||||
frozen analog input event double-precision float point with time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_DPwoTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 6
|
||||
frozen analog input event double-precision float point without time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_SPwTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 7
|
||||
frozen analog input event single-precision float point with time
|
||||
:bro:id:`dnp3_frozen_analog_input_event_SPwoTime`: :bro:type:`event` Generated for DNP3 objects with the group number 33 and variation number 5
|
||||
frozen analog input event single-precision float point without time
|
||||
:bro:id:`dnp3_frozen_counter_16wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 21 and variation number 2
|
||||
frozen counter 16 bit with flag
|
||||
:bro:id:`dnp3_frozen_counter_16wFlagTime`: :bro:type:`event` Generated for DNP3 objects with the group number 21 and variation number 6
|
||||
frozen counter 16 bit with flag and time
|
||||
:bro:id:`dnp3_frozen_counter_16woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 21 and variation number 10
|
||||
frozen counter 16 bit without flag
|
||||
:bro:id:`dnp3_frozen_counter_32wFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 21 and variation number 1
|
||||
frozen counter 32 bit with flag
|
||||
:bro:id:`dnp3_frozen_counter_32wFlagTime`: :bro:type:`event` Generated for DNP3 objects with the group number 21 and variation number 5
|
||||
frozen counter 32 bit with flag and time
|
||||
:bro:id:`dnp3_frozen_counter_32woFlag`: :bro:type:`event` Generated for DNP3 objects with the group number 21 and variation number 9
|
||||
frozen counter 32 bit without flag
|
||||
:bro:id:`dnp3_header_block`: :bro:type:`event` Generated for an additional header that the DNP3 analyzer passes to the
|
||||
script-level.
|
||||
:bro:id:`dnp3_object_header`: :bro:type:`event` Generated for the object header found in both DNP3 requests and responses.
|
||||
:bro:id:`dnp3_object_prefix`: :bro:type:`event` Generated for the prefix before a DNP3 object.
|
||||
:bro:id:`dnp3_pcb`: :bro:type:`event` Generated for DNP3 objects with the group number 12 and variation number 2
|
||||
PCB: Pattern Control Block
|
||||
:bro:id:`dnp3_response_data_object`: :bro:type:`event` Generated for a DNP3 "Response_Data_Object".
|
||||
==================================================================== ===========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: dnp3_analog_input_16wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 30 and variation number 2
|
||||
analog input 16 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_analog_input_16woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 30 and variation number 4
|
||||
analog input 16 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_analog_input_32wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 30 and variation number 1
|
||||
analog input 32 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_analog_input_32woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 30 and variation number 3
|
||||
analog input 32 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_analog_input_DPwFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value_low: :bro:type:`count`, value_high: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 30 and variation number 6
|
||||
analog input double precision, float point with flag
|
||||
|
||||
.. bro:id:: dnp3_analog_input_SPwFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 30 and variation number 5
|
||||
analog input single precision, float point with flag
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_16wTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 4
|
||||
analog input event 16 bit with time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_16woTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 2
|
||||
analog input event 16 bit without time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_32wTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 3
|
||||
analog input event 32 bit with time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_32woTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 1
|
||||
analog input event 32 bit without time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_DPwTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value_low: :bro:type:`count`, value_high: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 8
|
||||
analog input event double-precisiion float point with time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_DPwoTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value_low: :bro:type:`count`, value_high: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 6
|
||||
analog input event double-precision float point without time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_SPwTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 7
|
||||
analog input event single-precision float point with time
|
||||
|
||||
.. bro:id:: dnp3_analog_input_event_SPwoTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 32 and variation number 5
|
||||
analog input event single-precision float point without time
|
||||
|
||||
.. bro:id:: dnp3_application_request_header
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, application: :bro:type:`count`, fc: :bro:type:`count`)
|
||||
|
||||
Generated for a DNP3 request header.
|
||||
|
||||
|
||||
:c: The connection the DNP3 communication is part of.
|
||||
|
||||
|
||||
:is_orig: True if this reflects originator-side activity.
|
||||
|
||||
|
||||
:fc: function code.
|
||||
|
||||
|
||||
.. bro:id:: dnp3_application_response_header
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, application: :bro:type:`count`, fc: :bro:type:`count`, iin: :bro:type:`count`)
|
||||
|
||||
Generated for a DNP3 response header.
|
||||
|
||||
|
||||
:c: The connection the DNP3 communication is part of.
|
||||
|
||||
|
||||
:is_orig: True if this reflects originator-side activity.
|
||||
|
||||
|
||||
:fc: function code.
|
||||
|
||||
|
||||
:iin: internal indication number.
|
||||
|
||||
|
||||
.. bro:id:: dnp3_attribute_common
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, data_type_code: :bro:type:`count`, leng: :bro:type:`count`, attribute_obj: :bro:type:`string`)
|
||||
|
||||
Generated for DNP3 attributes.
|
||||
|
||||
.. bro:id:: dnp3_counter_16wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 20 and variation number 2
|
||||
counter 16 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_counter_16woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 20 and variation number 6
|
||||
counter 16 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_counter_32wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 20 and variation number 1
|
||||
counter 32 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_counter_32woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 20 and variation number 5
|
||||
counter 32 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_crob
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, control_code: :bro:type:`count`, count8: :bro:type:`count`, on_time: :bro:type:`count`, off_time: :bro:type:`count`, status_code: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 12 and variation number 1
|
||||
|
||||
:CROB: control relay output block
|
||||
|
||||
.. bro:id:: dnp3_debug_byte
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, debug: :bro:type:`string`)
|
||||
|
||||
Debugging event generated by the DNP3 analyzer. The "Debug_Byte" binpac unit
|
||||
generates this for unknown "cases". The user can use it to debug the byte
|
||||
string to check what caused the malformed network packets.
|
||||
|
||||
.. bro:id:: dnp3_file_transport
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, file_handle: :bro:type:`count`, block_num: :bro:type:`count`, file_data: :bro:type:`string`)
|
||||
|
||||
g70
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_16wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 2
|
||||
frozen analog input 16 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_16wTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 4
|
||||
frozen analog input 16 bit with time-of-freeze
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_16woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 6
|
||||
frozen analog input 16 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_32wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 1
|
||||
frozen analog input 32 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_32wTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 3
|
||||
frozen analog input 32 bit with time-of-freeze
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_32woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 5
|
||||
frozen analog input 32 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_DPwFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value_low: :bro:type:`count`, frozen_value_high: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 8
|
||||
frozen analog input double-precision, float point with flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_SPwFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 31 and variation number 7
|
||||
frozen analog input single-precision, float point with flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_16wTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 4
|
||||
frozen analog input event 16 bit with time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_16woTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 2
|
||||
frozen analog input event 16 bit without time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_32wTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 3
|
||||
frozen analog input event 32 bit with time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_32woTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 1
|
||||
frozen analog input event 32 bit without time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_DPwTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value_low: :bro:type:`count`, frozen_value_high: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 34 and variation number 8
|
||||
frozen analog input event double-precision float point with time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_DPwoTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value_low: :bro:type:`count`, frozen_value_high: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 6
|
||||
frozen analog input event double-precision float point without time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_SPwTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 7
|
||||
frozen analog input event single-precision float point with time
|
||||
|
||||
.. bro:id:: dnp3_frozen_analog_input_event_SPwoTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, frozen_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 33 and variation number 5
|
||||
frozen analog input event single-precision float point without time
|
||||
|
||||
.. bro:id:: dnp3_frozen_counter_16wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 21 and variation number 2
|
||||
frozen counter 16 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_counter_16wFlagTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, count_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 21 and variation number 6
|
||||
frozen counter 16 bit with flag and time
|
||||
|
||||
.. bro:id:: dnp3_frozen_counter_16woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 21 and variation number 10
|
||||
frozen counter 16 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_counter_32wFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 21 and variation number 1
|
||||
frozen counter 32 bit with flag
|
||||
|
||||
.. bro:id:: dnp3_frozen_counter_32wFlagTime
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, flag: :bro:type:`count`, count_value: :bro:type:`count`, time48: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 21 and variation number 5
|
||||
frozen counter 32 bit with flag and time
|
||||
|
||||
.. bro:id:: dnp3_frozen_counter_32woFlag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, count_value: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 21 and variation number 9
|
||||
frozen counter 32 bit without flag
|
||||
|
||||
.. bro:id:: dnp3_header_block
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, len: :bro:type:`count`, ctrl: :bro:type:`count`, dest_addr: :bro:type:`count`, src_addr: :bro:type:`count`)
|
||||
|
||||
Generated for an additional header that the DNP3 analyzer passes to the
|
||||
script-level. This header mimics the DNP3 transport-layer yet is only passed
|
||||
once for each sequence of DNP3 records (which are otherwise reassembled and
|
||||
treated as a single entity).
|
||||
|
||||
|
||||
:c: The connection the DNP3 communication is part of.
|
||||
|
||||
|
||||
:is_orig: True if this reflects originator-side activity.
|
||||
|
||||
|
||||
:len: the "length" field in the DNP3 Pseudo Link Layer.
|
||||
|
||||
|
||||
:ctrl: the "control" field in the DNP3 Pseudo Link Layer.
|
||||
|
||||
|
||||
:dest_addr: the "destination" field in the DNP3 Pseudo Link Layer.
|
||||
|
||||
|
||||
:src_addr: the "source" field in the DNP3 Pseudo Link Layer.
|
||||
|
||||
|
||||
.. bro:id:: dnp3_object_header
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, obj_type: :bro:type:`count`, qua_field: :bro:type:`count`, number: :bro:type:`count`, rf_low: :bro:type:`count`, rf_high: :bro:type:`count`)
|
||||
|
||||
Generated for the object header found in both DNP3 requests and responses.
|
||||
|
||||
|
||||
:c: The connection the DNP3 communication is part of.
|
||||
|
||||
|
||||
:is_orig: True if this reflects originator-side activity.
|
||||
|
||||
|
||||
:obj_type: type of object, which is classified based on an 8-bit group number
|
||||
and an 8-bit variation number.
|
||||
|
||||
|
||||
:qua_field: qualifier field.
|
||||
|
||||
|
||||
:number: TODO.
|
||||
|
||||
|
||||
:rf_low: the structure of the range field depends on the qualified field.
|
||||
In some cases, the range field contains only one logic part, e.g.,
|
||||
number of objects, so only *rf_low* contains useful values.
|
||||
|
||||
|
||||
:rf_high: in some cases, the range field contains two logic parts, e.g., start
|
||||
index and stop index, so *rf_low* contains the start index
|
||||
while *rf_high* contains the stop index.
|
||||
|
||||
|
||||
.. bro:id:: dnp3_object_prefix
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, prefix_value: :bro:type:`count`)
|
||||
|
||||
Generated for the prefix before a DNP3 object. The structure and the meaning
|
||||
of the prefix are defined by the qualifier field.
|
||||
|
||||
|
||||
:c: The connection the DNP3 communication is part of.
|
||||
|
||||
|
||||
:is_orig: True if this reflects originator-side activity.
|
||||
|
||||
|
||||
:prefix_value: The prefix.
|
||||
|
||||
|
||||
.. bro:id:: dnp3_pcb
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, control_code: :bro:type:`count`, count8: :bro:type:`count`, on_time: :bro:type:`count`, off_time: :bro:type:`count`, status_code: :bro:type:`count`)
|
||||
|
||||
Generated for DNP3 objects with the group number 12 and variation number 2
|
||||
|
||||
:PCB: Pattern Control Block
|
||||
|
||||
.. bro:id:: dnp3_response_data_object
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, data_value: :bro:type:`count`)
|
||||
|
||||
Generated for a DNP3 "Response_Data_Object".
|
||||
The "Response_Data_Object" contains two parts: object prefix and object
|
||||
data. In most cases, object data are defined by new record types. But
|
||||
in a few cases, object data are directly basic types, such as int16, or
|
||||
int8; thus we use an additional *data_value* to record the values of those
|
||||
object data.
|
||||
|
||||
|
||||
:c: The connection the DNP3 communication is part of.
|
||||
|
||||
|
||||
:is_orig: True if this reflects originator-side activity.
|
||||
|
||||
|
||||
:data_value: The value for those objects that carry their information here
|
||||
directly.
|
||||
|
||||
|
||||
|
||||
838
doc/scripts/base/bif/plugins/Bro_DNS.events.bif.bro.rst
Normal file
838
doc/scripts/base/bif/plugins/Bro_DNS.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,838 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_DNS.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================== ================================================================================
|
||||
:bro:id:`dns_A6_reply`: :bro:type:`event` Generated for DNS replies of type *A6*.
|
||||
:bro:id:`dns_AAAA_reply`: :bro:type:`event` Generated for DNS replies of type *AAAA*.
|
||||
:bro:id:`dns_A_reply`: :bro:type:`event` Generated for DNS replies of type *A*.
|
||||
:bro:id:`dns_CAA_reply`: :bro:type:`event` Generated for DNS replies of type *CAA* (Certification Authority Authorization).
|
||||
:bro:id:`dns_CNAME_reply`: :bro:type:`event` Generated for DNS replies of type *CNAME*.
|
||||
:bro:id:`dns_DNSKEY`: :bro:type:`event` Generated for DNS replies of type *DNSKEY*.
|
||||
:bro:id:`dns_DS`: :bro:type:`event` Generated for DNS replies of type *DS*.
|
||||
:bro:id:`dns_EDNS_addl`: :bro:type:`event` Generated for DNS replies of type *EDNS*.
|
||||
:bro:id:`dns_HINFO_reply`: :bro:type:`event` Generated for DNS replies of type *HINFO*.
|
||||
:bro:id:`dns_MX_reply`: :bro:type:`event` Generated for DNS replies of type *MX*.
|
||||
:bro:id:`dns_NSEC`: :bro:type:`event` Generated for DNS replies of type *NSEC*.
|
||||
:bro:id:`dns_NSEC3`: :bro:type:`event` Generated for DNS replies of type *NSEC3*.
|
||||
:bro:id:`dns_NS_reply`: :bro:type:`event` Generated for DNS replies of type *NS*.
|
||||
:bro:id:`dns_PTR_reply`: :bro:type:`event` Generated for DNS replies of type *PTR*.
|
||||
:bro:id:`dns_RRSIG`: :bro:type:`event` Generated for DNS replies of type *RRSIG*.
|
||||
:bro:id:`dns_SOA_reply`: :bro:type:`event` Generated for DNS replies of type *CNAME*.
|
||||
:bro:id:`dns_SRV_reply`: :bro:type:`event` Generated for DNS replies of type *SRV*.
|
||||
:bro:id:`dns_TSIG_addl`: :bro:type:`event` Generated for DNS replies of type *TSIG*.
|
||||
:bro:id:`dns_TXT_reply`: :bro:type:`event` Generated for DNS replies of type *TXT*.
|
||||
:bro:id:`dns_WKS_reply`: :bro:type:`event` Generated for DNS replies of type *WKS*.
|
||||
:bro:id:`dns_end`: :bro:type:`event` Generated at the end of processing a DNS packet.
|
||||
:bro:id:`dns_full_request`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`dns_message`: :bro:type:`event` Generated for all DNS messages.
|
||||
:bro:id:`dns_query_reply`: :bro:type:`event` Generated for each entry in the Question section of a DNS reply.
|
||||
:bro:id:`dns_rejected`: :bro:type:`event` Generated for DNS replies that reject a query.
|
||||
:bro:id:`dns_request`: :bro:type:`event` Generated for DNS requests.
|
||||
:bro:id:`dns_unknown_reply`: :bro:type:`event` Generated on DNS reply resource records when the type of record is not one
|
||||
that Bro knows how to parse and generate another more specific event.
|
||||
:bro:id:`non_dns_request`: :bro:type:`event` msg: The raw DNS payload.
|
||||
============================================== ================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: dns_A6_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, a: :bro:type:`addr`)
|
||||
|
||||
Generated for DNS replies of type *A6*. For replies with multiple answers, an
|
||||
individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:a: The address returned by the reply.
|
||||
|
||||
.. bro:see:: dns_A_reply dns_AAAA_reply dns_CNAME_reply dns_EDNS_addl dns_HINFO_reply dns_MX_reply
|
||||
dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply dns_TSIG_addl
|
||||
dns_TXT_reply dns_WKS_reply dns_end dns_full_request dns_mapping_altered
|
||||
dns_mapping_lost_name dns_mapping_new_name dns_mapping_unverified
|
||||
dns_mapping_valid dns_message dns_query_reply dns_rejected dns_request
|
||||
non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_AAAA_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, a: :bro:type:`addr`)
|
||||
|
||||
Generated for DNS replies of type *AAAA*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:a: The address returned by the reply.
|
||||
|
||||
.. bro:see:: dns_A_reply dns_A6_reply dns_CNAME_reply dns_EDNS_addl dns_HINFO_reply dns_MX_reply
|
||||
dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply dns_TSIG_addl
|
||||
dns_TXT_reply dns_WKS_reply dns_end dns_full_request dns_mapping_altered
|
||||
dns_mapping_lost_name dns_mapping_new_name dns_mapping_unverified
|
||||
dns_mapping_valid dns_message dns_query_reply dns_rejected dns_request
|
||||
non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_A_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, a: :bro:type:`addr`)
|
||||
|
||||
Generated for DNS replies of type *A*. For replies with multiple answers, an
|
||||
individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:a: The address returned by the reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A6_reply dns_CNAME_reply dns_EDNS_addl dns_HINFO_reply
|
||||
dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_CAA_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, flags: :bro:type:`count`, tag: :bro:type:`string`, value: :bro:type:`string`)
|
||||
|
||||
Generated for DNS replies of type *CAA* (Certification Authority Authorization).
|
||||
For replies with multiple answers, an individual event of the corresponding type
|
||||
is raised for each.
|
||||
See `RFC 6844 <https://tools.ietf.org/html/rfc6844>`__ for more details.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:flags: The flags byte of the CAA reply.
|
||||
|
||||
|
||||
:tag: The property identifier of the CAA reply.
|
||||
|
||||
|
||||
:value: The property value of the CAA reply.
|
||||
|
||||
.. bro:id:: dns_CNAME_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, name: :bro:type:`string`)
|
||||
|
||||
Generated for DNS replies of type *CNAME*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:name: The name returned by the reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_EDNS_addl dns_HINFO_reply dns_MX_reply
|
||||
dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply dns_TSIG_addl
|
||||
dns_TXT_reply dns_WKS_reply dns_end dns_full_request dns_mapping_altered
|
||||
dns_mapping_lost_name dns_mapping_new_name dns_mapping_unverified
|
||||
dns_mapping_valid dns_message dns_query_reply dns_rejected dns_request
|
||||
non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_DNSKEY
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, dnskey: :bro:type:`dns_dnskey_rr`)
|
||||
|
||||
Generated for DNS replies of type *DNSKEY*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:dnskey: The parsed DNSKEY record.
|
||||
|
||||
.. bro:id:: dns_DS
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, ds: :bro:type:`dns_ds_rr`)
|
||||
|
||||
Generated for DNS replies of type *DS*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:ds: The parsed RDATA of DS record.
|
||||
|
||||
.. bro:id:: dns_EDNS_addl
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_edns_additional`)
|
||||
|
||||
Generated for DNS replies of type *EDNS*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The parsed EDNS reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_HINFO_reply dns_MX_reply
|
||||
dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply dns_TSIG_addl
|
||||
dns_TXT_reply dns_WKS_reply dns_end dns_full_request dns_mapping_altered
|
||||
dns_mapping_lost_name dns_mapping_new_name dns_mapping_unverified
|
||||
dns_mapping_valid dns_message dns_query_reply dns_rejected dns_request
|
||||
non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_HINFO_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`)
|
||||
|
||||
Generated for DNS replies of type *HINFO*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl dns_MX_reply
|
||||
dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply dns_TSIG_addl
|
||||
dns_TXT_reply dns_WKS_reply dns_end dns_full_request dns_mapping_altered
|
||||
dns_mapping_lost_name dns_mapping_new_name dns_mapping_unverified
|
||||
dns_mapping_valid dns_message dns_query_reply dns_rejected dns_request
|
||||
non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_MX_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, name: :bro:type:`string`, preference: :bro:type:`count`)
|
||||
|
||||
Generated for DNS replies of type *MX*. For replies with multiple answers, an
|
||||
individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:name: The name returned by the reply.
|
||||
|
||||
|
||||
:preference: The preference for *name* specified by the reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_NS_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_NSEC
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, next_name: :bro:type:`string`, bitmaps: :bro:type:`string_vec`)
|
||||
|
||||
Generated for DNS replies of type *NSEC*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:next_name: The parsed next secure domain name.
|
||||
|
||||
|
||||
:bitmaps: vector of strings in hex for the bit maps present.
|
||||
|
||||
.. bro:id:: dns_NSEC3
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, nsec3: :bro:type:`dns_nsec3_rr`)
|
||||
|
||||
Generated for DNS replies of type *NSEC3*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:nsec3: The parsed RDATA of Nsec3 record.
|
||||
|
||||
.. bro:id:: dns_NS_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, name: :bro:type:`string`)
|
||||
|
||||
Generated for DNS replies of type *NS*. For replies with multiple answers, an
|
||||
individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:name: The name returned by the reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_PTR_reply dns_SOA_reply dns_SRV_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_PTR_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, name: :bro:type:`string`)
|
||||
|
||||
Generated for DNS replies of type *PTR*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:name: The name returned by the reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_SOA_reply dns_SRV_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_RRSIG
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, rrsig: :bro:type:`dns_rrsig_rr`)
|
||||
|
||||
Generated for DNS replies of type *RRSIG*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:rrsig: The parsed RRSIG record.
|
||||
|
||||
.. bro:id:: dns_SOA_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, soa: :bro:type:`dns_soa`)
|
||||
|
||||
Generated for DNS replies of type *CNAME*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:soa: The parsed SOA value.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SRV_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_SRV_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, target: :bro:type:`string`, priority: :bro:type:`count`, weight: :bro:type:`count`, p: :bro:type:`count`)
|
||||
|
||||
Generated for DNS replies of type *SRV*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:target: Target of the SRV response -- the canonical hostname of the
|
||||
machine providing the service, ending in a dot.
|
||||
|
||||
|
||||
:priority: Priority of the SRV response -- the priority of the target
|
||||
host, lower value means more preferred.
|
||||
|
||||
|
||||
:weight: Weight of the SRV response -- a relative weight for records
|
||||
with the same priority, higher value means more preferred.
|
||||
|
||||
|
||||
:p: Port of the SRV response -- the TCP or UDP port on which the
|
||||
service is to be found.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_TSIG_addl
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_tsig_additional`)
|
||||
|
||||
Generated for DNS replies of type *TSIG*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The parsed TSIG reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TXT_reply dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_TXT_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`, strs: :bro:type:`string_vec`)
|
||||
|
||||
Generated for DNS replies of type *TXT*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
|
||||
:strs: The textual information returned by the reply.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_WKS_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_WKS_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`)
|
||||
|
||||
Generated for DNS replies of type *WKS*. For replies with multiple answers,
|
||||
an individual event of the corresponding type is raised for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_end dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_end
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`)
|
||||
|
||||
Generated at the end of processing a DNS packet. This event is the last
|
||||
``dns_*`` event that will be raised for a DNS query/reply and signals that
|
||||
all resource records have been passed on.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_full_request
|
||||
dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected dns_request non_dns_request dns_max_queries dns_session_timeout
|
||||
dns_skip_addl dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_full_request
|
||||
|
||||
:Type: :bro:type:`event` ()
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. todo:: Unclear what this event is for; it's never raised. We should just
|
||||
remove it.
|
||||
|
||||
.. bro:id:: dns_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`dns_msg`, len: :bro:type:`count`)
|
||||
|
||||
Generated for all DNS messages.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:is_orig: True if the message was sent by the originator of the connection.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:len: The length of the message's raw representation (i.e., the DNS payload).
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end
|
||||
dns_full_request dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_query_reply dns_rejected
|
||||
dns_request non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_query_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, query: :bro:type:`string`, qtype: :bro:type:`count`, qclass: :bro:type:`count`)
|
||||
|
||||
Generated for each entry in the Question section of a DNS reply.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:query: The queried name.
|
||||
|
||||
|
||||
:qtype: The queried resource record type.
|
||||
|
||||
|
||||
:qclass: The queried resource record class.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end
|
||||
dns_full_request dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_rejected
|
||||
dns_request non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_rejected
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, query: :bro:type:`string`, qtype: :bro:type:`count`, qclass: :bro:type:`count`)
|
||||
|
||||
Generated for DNS replies that reject a query. This event is raised if a DNS
|
||||
reply indicates failure because it does not pass on any
|
||||
answers to a query. Note that all of the event's parameters are parsed out of
|
||||
the reply; there's no stateful correlation with the query.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:query: The queried name.
|
||||
|
||||
|
||||
:qtype: The queried resource record type.
|
||||
|
||||
|
||||
:qclass: The queried resource record class.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end
|
||||
dns_full_request dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_request non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, query: :bro:type:`string`, qtype: :bro:type:`count`, qclass: :bro:type:`count`)
|
||||
|
||||
Generated for DNS requests. For requests with multiple queries, this event
|
||||
is raised once for each.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Domain_Name_System>`__ for more
|
||||
information about the DNS protocol. Bro analyzes both UDP and TCP DNS
|
||||
sessions.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:query: The queried name.
|
||||
|
||||
|
||||
:qtype: The queried resource record type.
|
||||
|
||||
|
||||
:qclass: The queried resource record class.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_SRV_reply dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_end
|
||||
dns_full_request dns_mapping_altered dns_mapping_lost_name dns_mapping_new_name
|
||||
dns_mapping_unverified dns_mapping_valid dns_message dns_query_reply
|
||||
dns_rejected non_dns_request dns_max_queries dns_session_timeout dns_skip_addl
|
||||
dns_skip_all_addl dns_skip_all_auth dns_skip_auth
|
||||
|
||||
.. bro:id:: dns_unknown_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`dns_msg`, ans: :bro:type:`dns_answer`)
|
||||
|
||||
Generated on DNS reply resource records when the type of record is not one
|
||||
that Bro knows how to parse and generate another more specific event.
|
||||
|
||||
|
||||
:c: The connection, which may be UDP or TCP depending on the type of the
|
||||
transport-layer session being analyzed.
|
||||
|
||||
|
||||
:msg: The parsed DNS message header.
|
||||
|
||||
|
||||
:ans: The type-independent part of the parsed answer record.
|
||||
|
||||
.. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
|
||||
dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
|
||||
dns_TSIG_addl dns_TXT_reply dns_WKS_reply dns_SRV_reply dns_end
|
||||
|
||||
.. bro:id:: non_dns_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`)
|
||||
|
||||
|
||||
:msg: The raw DNS payload.
|
||||
|
||||
.. note:: This event is deprecated and superseded by Bro's dynamic protocol
|
||||
detection framework.
|
||||
|
||||
|
||||
72
doc/scripts/base/bif/plugins/Bro_FTP.events.bif.bro.rst
Normal file
72
doc/scripts/base/bif/plugins/Bro_FTP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,72 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_FTP.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================== =======================================
|
||||
:bro:id:`ftp_reply`: :bro:type:`event` Generated for server-side FTP replies.
|
||||
:bro:id:`ftp_request`: :bro:type:`event` Generated for client-side FTP commands.
|
||||
======================================== =======================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ftp_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, code: :bro:type:`count`, msg: :bro:type:`string`, cont_resp: :bro:type:`bool`)
|
||||
|
||||
Generated for server-side FTP replies.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/File_Transfer_Protocol>`__ for
|
||||
more information about the FTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:code: The numerical response code the server responded with.
|
||||
|
||||
|
||||
:msg: The textual message of the response.
|
||||
|
||||
|
||||
:cont_resp: True if the reply line is tagged as being continued to the next
|
||||
line. If so, further events will be raised and a handler may want
|
||||
to reassemble the pieces before processing the response any
|
||||
further.
|
||||
|
||||
.. bro:see:: ftp_request fmt_ftp_port parse_eftp_port
|
||||
parse_ftp_epsv parse_ftp_pasv parse_ftp_port
|
||||
|
||||
.. bro:id:: ftp_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, command: :bro:type:`string`, arg: :bro:type:`string`)
|
||||
|
||||
Generated for client-side FTP commands.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/File_Transfer_Protocol>`__ for
|
||||
more information about the FTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:command: The FTP command issued by the client (without any arguments).
|
||||
|
||||
|
||||
:arg: The arguments going with the command.
|
||||
|
||||
.. bro:see:: ftp_reply fmt_ftp_port parse_eftp_port
|
||||
parse_ftp_epsv parse_ftp_pasv parse_ftp_port
|
||||
|
||||
|
||||
110
doc/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro.rst
Normal file
110
doc/scripts/base/bif/plugins/Bro_FTP.functions.bif.bro.rst
Normal file
|
|
@ -0,0 +1,110 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_FTP.functions.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
=============================================== ==========================================================================
|
||||
:bro:id:`fmt_ftp_port`: :bro:type:`function` Formats an IP address and TCP port as an FTP PORT command.
|
||||
:bro:id:`parse_eftp_port`: :bro:type:`function` Converts a string representation of the FTP EPRT command (see :rfc:`2428`)
|
||||
to an :bro:type:`ftp_port`.
|
||||
:bro:id:`parse_ftp_epsv`: :bro:type:`function` Converts the result of the FTP EPSV command (see :rfc:`2428`) to an
|
||||
:bro:type:`ftp_port`.
|
||||
:bro:id:`parse_ftp_pasv`: :bro:type:`function` Converts the result of the FTP PASV command to an :bro:type:`ftp_port`.
|
||||
:bro:id:`parse_ftp_port`: :bro:type:`function` Converts a string representation of the FTP PORT command to an
|
||||
:bro:type:`ftp_port`.
|
||||
=============================================== ==========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: fmt_ftp_port
|
||||
|
||||
:Type: :bro:type:`function` (a: :bro:type:`addr`, p: :bro:type:`port`) : :bro:type:`string`
|
||||
|
||||
Formats an IP address and TCP port as an FTP PORT command. For example,
|
||||
``10.0.0.1`` and ``1055/tcp`` yields ``"10,0,0,1,4,31"``.
|
||||
|
||||
|
||||
:a: The IP address.
|
||||
|
||||
|
||||
:p: The TCP port.
|
||||
|
||||
|
||||
:returns: The FTP PORT string.
|
||||
|
||||
.. bro:see:: parse_ftp_port parse_eftp_port parse_ftp_pasv parse_ftp_epsv
|
||||
|
||||
.. bro:id:: parse_eftp_port
|
||||
|
||||
:Type: :bro:type:`function` (s: :bro:type:`string`) : :bro:type:`ftp_port`
|
||||
|
||||
Converts a string representation of the FTP EPRT command (see :rfc:`2428`)
|
||||
to an :bro:type:`ftp_port`. The format is
|
||||
``"EPRT<space><d><net-prt><d><net-addr><d><tcp-port><d>"``,
|
||||
where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``).
|
||||
|
||||
|
||||
:s: The string of the FTP EPRT command, e.g., ``"|1|10.0.0.1|1055|"``.
|
||||
|
||||
|
||||
:returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]``.
|
||||
|
||||
.. bro:see:: parse_ftp_port parse_ftp_pasv parse_ftp_epsv fmt_ftp_port
|
||||
|
||||
.. bro:id:: parse_ftp_epsv
|
||||
|
||||
:Type: :bro:type:`function` (str: :bro:type:`string`) : :bro:type:`ftp_port`
|
||||
|
||||
Converts the result of the FTP EPSV command (see :rfc:`2428`) to an
|
||||
:bro:type:`ftp_port`. The format is ``"<text> (<d><d><d><tcp-port><d>)"``,
|
||||
where ``<d>`` is a delimiter in the ASCII range 33-126 (usually ``|``).
|
||||
|
||||
|
||||
:str: The string containing the result of the FTP EPSV command.
|
||||
|
||||
|
||||
:returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]``.
|
||||
|
||||
.. bro:see:: parse_ftp_port parse_eftp_port parse_ftp_pasv fmt_ftp_port
|
||||
|
||||
.. bro:id:: parse_ftp_pasv
|
||||
|
||||
:Type: :bro:type:`function` (str: :bro:type:`string`) : :bro:type:`ftp_port`
|
||||
|
||||
Converts the result of the FTP PASV command to an :bro:type:`ftp_port`.
|
||||
|
||||
|
||||
:str: The string containing the result of the FTP PASV command.
|
||||
|
||||
|
||||
:returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]``.
|
||||
|
||||
.. bro:see:: parse_ftp_port parse_eftp_port parse_ftp_epsv fmt_ftp_port
|
||||
|
||||
.. bro:id:: parse_ftp_port
|
||||
|
||||
:Type: :bro:type:`function` (s: :bro:type:`string`) : :bro:type:`ftp_port`
|
||||
|
||||
Converts a string representation of the FTP PORT command to an
|
||||
:bro:type:`ftp_port`.
|
||||
|
||||
|
||||
:s: The string of the FTP PORT command, e.g., ``"10,0,0,1,4,31"``.
|
||||
|
||||
|
||||
:returns: The FTP PORT, e.g., ``[h=10.0.0.1, p=1055/tcp, valid=T]``.
|
||||
|
||||
.. bro:see:: parse_eftp_port parse_ftp_pasv parse_ftp_epsv fmt_ftp_port
|
||||
|
||||
|
||||
44
doc/scripts/base/bif/plugins/Bro_File.events.bif.bro.rst
Normal file
44
doc/scripts/base/bif/plugins/Bro_File.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_File.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================= ========================================================================
|
||||
:bro:id:`file_transferred`: :bro:type:`event` Generated when a TCP connection associated w/ file data transfer is seen
|
||||
(e.g.
|
||||
============================================= ========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: file_transferred
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, prefix: :bro:type:`string`, descr: :bro:type:`string`, mime_type: :bro:type:`string`)
|
||||
|
||||
Generated when a TCP connection associated w/ file data transfer is seen
|
||||
(e.g. as happens w/ FTP or IRC).
|
||||
|
||||
|
||||
:c: The connection over which file data is transferred.
|
||||
|
||||
|
||||
:prefix: Up to 1024 bytes of the file data.
|
||||
|
||||
|
||||
:descr: Deprecated/unused argument.
|
||||
|
||||
|
||||
:mime_type: MIME type of the file or "<unknown>" if no file magic signatures
|
||||
matched.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_FileEntropy.events.bif.bro
|
||||
===============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================= ========================================================
|
||||
:bro:id:`file_entropy`: :bro:type:`event` This event is generated each time file analysis performs
|
||||
entropy testing on a file.
|
||||
========================================= ========================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: file_entropy
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, ent: :bro:type:`entropy_test_result`)
|
||||
|
||||
This event is generated each time file analysis performs
|
||||
entropy testing on a file.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:ent: The results of the entropy testing.
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_FileExtract.events.bif.bro
|
||||
===============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================== ================================================================
|
||||
:bro:id:`file_extraction_limit`: :bro:type:`event` This event is generated when a file extraction analyzer is about
|
||||
to exceed the maximum permitted file size allowed by the
|
||||
*extract_limit* field of :bro:see:`Files::AnalyzerArgs`.
|
||||
================================================== ================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: file_extraction_limit
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, args: :bro:type:`Files::AnalyzerArgs`, limit: :bro:type:`count`, len: :bro:type:`count`)
|
||||
|
||||
This event is generated when a file extraction analyzer is about
|
||||
to exceed the maximum permitted file size allowed by the
|
||||
*extract_limit* field of :bro:see:`Files::AnalyzerArgs`.
|
||||
The analyzer is automatically removed from file *f*.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:args: Arguments that identify a particular file extraction analyzer.
|
||||
This is only provided to be able to pass along to
|
||||
:bro:see:`FileExtract::set_limit`.
|
||||
|
||||
|
||||
:limit: The limit, in bytes, the extracted file is about to breach.
|
||||
|
||||
|
||||
:len: The length of the file chunk about to be written.
|
||||
|
||||
.. bro:see:: Files::add_analyzer Files::ANALYZER_EXTRACT
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_FileExtract.functions.bif.bro
|
||||
==================================================
|
||||
.. bro:namespace:: FileExtract
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
Internal functions used by the extraction file analyzer.
|
||||
|
||||
:Namespaces: FileExtract, GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
======================================================== ==================================
|
||||
:bro:id:`FileExtract::__set_limit`: :bro:type:`function` :bro:see:`FileExtract::set_limit`.
|
||||
======================================================== ==================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: FileExtract::__set_limit
|
||||
|
||||
:Type: :bro:type:`function` (file_id: :bro:type:`string`, args: :bro:type:`any`, n: :bro:type:`count`) : :bro:type:`bool`
|
||||
|
||||
:bro:see:`FileExtract::set_limit`.
|
||||
|
||||
|
||||
43
doc/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro.rst
Normal file
43
doc/scripts/base/bif/plugins/Bro_FileHash.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_FileHash.events.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
====================================== =========================================================================
|
||||
:bro:id:`file_hash`: :bro:type:`event` This event is generated each time file analysis generates a digest of the
|
||||
file contents.
|
||||
====================================== =========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: file_hash
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, kind: :bro:type:`string`, hash: :bro:type:`string`)
|
||||
|
||||
This event is generated each time file analysis generates a digest of the
|
||||
file contents.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:kind: The type of digest algorithm.
|
||||
|
||||
|
||||
:hash: The result of the hashing.
|
||||
|
||||
.. bro:see:: Files::add_analyzer Files::ANALYZER_MD5
|
||||
Files::ANALYZER_SHA1 Files::ANALYZER_SHA256
|
||||
|
||||
|
||||
74
doc/scripts/base/bif/plugins/Bro_Finger.events.bif.bro.rst
Normal file
74
doc/scripts/base/bif/plugins/Bro_Finger.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_Finger.events.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=========================================== ==============================
|
||||
:bro:id:`finger_reply`: :bro:type:`event` Generated for Finger replies.
|
||||
:bro:id:`finger_request`: :bro:type:`event` Generated for Finger requests.
|
||||
=========================================== ==============================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: finger_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, reply_line: :bro:type:`string`)
|
||||
|
||||
Generated for Finger replies.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Finger_protocol>`__ for more
|
||||
information about the Finger protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:reply_line: The reply as returned by the server
|
||||
|
||||
.. bro:see:: finger_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: finger_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, full: :bro:type:`bool`, username: :bro:type:`string`, hostname: :bro:type:`string`)
|
||||
|
||||
Generated for Finger requests.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Finger_protocol>`__ for more
|
||||
information about the Finger protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:full: True if verbose information is requested (``/W`` switch).
|
||||
|
||||
|
||||
:username: The request's user name.
|
||||
|
||||
|
||||
:hostname: The request's host name.
|
||||
|
||||
.. bro:see:: finger_reply
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
36
doc/scripts/base/bif/plugins/Bro_GSSAPI.events.bif.bro.rst
Normal file
36
doc/scripts/base/bif/plugins/Bro_GSSAPI.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_GSSAPI.events.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================== =========================================
|
||||
:bro:id:`gssapi_neg_result`: :bro:type:`event` Generated for GSSAPI negotiation results.
|
||||
============================================== =========================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: gssapi_neg_result
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, state: :bro:type:`count`)
|
||||
|
||||
Generated for GSSAPI negotiation results.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:state: The resulting state of the negotiation.
|
||||
|
||||
|
||||
|
||||
151
doc/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro.rst
Normal file
151
doc/scripts/base/bif/plugins/Bro_GTPv1.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,151 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_GTPv1.events.bif.bro
|
||||
=========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================== ===========================================================
|
||||
:bro:id:`gtpv1_create_pdp_ctx_request`: :bro:type:`event` Generated for GTPv1-C Create PDP Context Request messages.
|
||||
:bro:id:`gtpv1_create_pdp_ctx_response`: :bro:type:`event` Generated for GTPv1-C Create PDP Context Response messages.
|
||||
:bro:id:`gtpv1_delete_pdp_ctx_request`: :bro:type:`event` Generated for GTPv1-C Delete PDP Context Request messages.
|
||||
:bro:id:`gtpv1_delete_pdp_ctx_response`: :bro:type:`event` Generated for GTPv1-C Delete PDP Context Response messages.
|
||||
:bro:id:`gtpv1_g_pdu_packet`: :bro:type:`event` Generated for GTPv1 G-PDU packets.
|
||||
:bro:id:`gtpv1_message`: :bro:type:`event` Generated for any GTP message with a GTPv1 header.
|
||||
:bro:id:`gtpv1_update_pdp_ctx_request`: :bro:type:`event` Generated for GTPv1-C Update PDP Context Request messages.
|
||||
:bro:id:`gtpv1_update_pdp_ctx_response`: :bro:type:`event` Generated for GTPv1-C Update PDP Context Response messages.
|
||||
========================================================== ===========================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: gtpv1_create_pdp_ctx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`, elements: :bro:type:`gtp_create_pdp_ctx_request_elements`)
|
||||
|
||||
Generated for GTPv1-C Create PDP Context Request messages.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
|
||||
:elements: The set of Information Elements comprising the message.
|
||||
|
||||
.. bro:id:: gtpv1_create_pdp_ctx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`, elements: :bro:type:`gtp_create_pdp_ctx_response_elements`)
|
||||
|
||||
Generated for GTPv1-C Create PDP Context Response messages.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
|
||||
:elements: The set of Information Elements comprising the message.
|
||||
|
||||
.. bro:id:: gtpv1_delete_pdp_ctx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`, elements: :bro:type:`gtp_delete_pdp_ctx_request_elements`)
|
||||
|
||||
Generated for GTPv1-C Delete PDP Context Request messages.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
|
||||
:elements: The set of Information Elements comprising the message.
|
||||
|
||||
.. bro:id:: gtpv1_delete_pdp_ctx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`, elements: :bro:type:`gtp_delete_pdp_ctx_response_elements`)
|
||||
|
||||
Generated for GTPv1-C Delete PDP Context Response messages.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
|
||||
:elements: The set of Information Elements comprising the message.
|
||||
|
||||
.. bro:id:: gtpv1_g_pdu_packet
|
||||
|
||||
:Type: :bro:type:`event` (outer: :bro:type:`connection`, inner_gtp: :bro:type:`gtpv1_hdr`, inner_ip: :bro:type:`pkt_hdr`)
|
||||
|
||||
Generated for GTPv1 G-PDU packets. That is, packets with a UDP payload
|
||||
that includes a GTP header followed by an IPv4 or IPv6 packet.
|
||||
|
||||
|
||||
:outer: The GTP outer tunnel connection.
|
||||
|
||||
|
||||
:inner_gtp: The GTP header.
|
||||
|
||||
|
||||
:inner_ip: The inner IP and transport layer packet headers.
|
||||
|
||||
.. note:: Since this event may be raised on a per-packet basis, handling
|
||||
it may become particularly expensive for real-time analysis.
|
||||
|
||||
.. bro:id:: gtpv1_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`)
|
||||
|
||||
Generated for any GTP message with a GTPv1 header.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
.. bro:id:: gtpv1_update_pdp_ctx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`, elements: :bro:type:`gtp_update_pdp_ctx_request_elements`)
|
||||
|
||||
Generated for GTPv1-C Update PDP Context Request messages.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
|
||||
:elements: The set of Information Elements comprising the message.
|
||||
|
||||
.. bro:id:: gtpv1_update_pdp_ctx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`gtpv1_hdr`, elements: :bro:type:`gtp_update_pdp_ctx_response_elements`)
|
||||
|
||||
Generated for GTPv1-C Update PDP Context Response messages.
|
||||
|
||||
|
||||
:c: The connection over which the message is sent.
|
||||
|
||||
|
||||
:hdr: The GTPv1 header.
|
||||
|
||||
|
||||
:elements: The set of Information Elements comprising the message.
|
||||
|
||||
|
||||
131
doc/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro.rst
Normal file
131
doc/scripts/base/bif/plugins/Bro_Gnutella.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,131 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_Gnutella.events.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================== =====
|
||||
:bro:id:`gnutella_binary_msg`: :bro:type:`event` TODO.
|
||||
:bro:id:`gnutella_establish`: :bro:type:`event` TODO.
|
||||
:bro:id:`gnutella_http_notify`: :bro:type:`event` TODO.
|
||||
:bro:id:`gnutella_not_establish`: :bro:type:`event` TODO.
|
||||
:bro:id:`gnutella_partial_binary_msg`: :bro:type:`event` TODO.
|
||||
:bro:id:`gnutella_text_msg`: :bro:type:`event` TODO.
|
||||
======================================================== =====
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: gnutella_binary_msg
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, orig: :bro:type:`bool`, msg_type: :bro:type:`count`, ttl: :bro:type:`count`, hops: :bro:type:`count`, msg_len: :bro:type:`count`, payload: :bro:type:`string`, payload_len: :bro:type:`count`, trunc: :bro:type:`bool`, complete: :bro:type:`bool`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more
|
||||
information about the Gnutella protocol.
|
||||
|
||||
.. bro:see:: gnutella_establish gnutella_http_notify gnutella_not_establish
|
||||
gnutella_partial_binary_msg gnutella_signature_found gnutella_text_msg
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: gnutella_establish
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more
|
||||
information about the Gnutella protocol.
|
||||
|
||||
.. bro:see:: gnutella_binary_msg gnutella_http_notify gnutella_not_establish
|
||||
gnutella_partial_binary_msg gnutella_signature_found gnutella_text_msg
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: gnutella_http_notify
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more
|
||||
information about the Gnutella protocol.
|
||||
|
||||
.. bro:see:: gnutella_binary_msg gnutella_establish gnutella_not_establish
|
||||
gnutella_partial_binary_msg gnutella_signature_found gnutella_text_msg
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: gnutella_not_establish
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more
|
||||
information about the Gnutella protocol.
|
||||
|
||||
.. bro:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify
|
||||
gnutella_partial_binary_msg gnutella_signature_found gnutella_text_msg
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: gnutella_partial_binary_msg
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, orig: :bro:type:`bool`, msg: :bro:type:`string`, len: :bro:type:`count`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more
|
||||
information about the Gnutella protocol.
|
||||
|
||||
.. bro:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify
|
||||
gnutella_not_establish gnutella_signature_found gnutella_text_msg
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: gnutella_text_msg
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, orig: :bro:type:`bool`, headers: :bro:type:`string`)
|
||||
|
||||
TODO.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Gnutella>`__ for more
|
||||
information about the Gnutella protocol.
|
||||
|
||||
.. bro:see:: gnutella_binary_msg gnutella_establish gnutella_http_notify
|
||||
gnutella_not_establish gnutella_partial_binary_msg gnutella_signature_found
|
||||
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
358
doc/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro.rst
Normal file
358
doc/scripts/base/bif/plugins/Bro_HTTP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,358 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_HTTP.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================== ========================================================================
|
||||
:bro:id:`http_all_headers`: :bro:type:`event` Generated for HTTP headers, passing on all headers of an HTTP message at
|
||||
once.
|
||||
:bro:id:`http_begin_entity`: :bro:type:`event` Generated when starting to parse an HTTP body entity.
|
||||
:bro:id:`http_connection_upgrade`: :bro:type:`event` Generated when a HTTP session is upgraded to a different protocol (e.g.
|
||||
:bro:id:`http_content_type`: :bro:type:`event` Generated for reporting an HTTP body's content type.
|
||||
:bro:id:`http_end_entity`: :bro:type:`event` Generated when finishing parsing an HTTP body entity.
|
||||
:bro:id:`http_entity_data`: :bro:type:`event` Generated when parsing an HTTP body entity, passing on the data.
|
||||
:bro:id:`http_event`: :bro:type:`event` Generated for errors found when decoding HTTP requests or replies.
|
||||
:bro:id:`http_header`: :bro:type:`event` Generated for HTTP headers.
|
||||
:bro:id:`http_message_done`: :bro:type:`event` Generated once at the end of parsing an HTTP message.
|
||||
:bro:id:`http_reply`: :bro:type:`event` Generated for HTTP replies.
|
||||
:bro:id:`http_request`: :bro:type:`event` Generated for HTTP requests.
|
||||
:bro:id:`http_stats`: :bro:type:`event` Generated at the end of an HTTP session to report statistics about it.
|
||||
==================================================== ========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: http_all_headers
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, hlist: :bro:type:`mime_header_list`)
|
||||
|
||||
Generated for HTTP headers, passing on all headers of an HTTP message at
|
||||
once. Bro supports persistent and pipelined HTTP sessions and raises
|
||||
corresponding events as it parses client/server dialogues.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the header was sent by the originator of the TCP connection.
|
||||
|
||||
|
||||
:hlist: A *table* containing all headers extracted from the current entity.
|
||||
The table is indexed by the position of the header (1 for the first,
|
||||
2 for the second, etc.).
|
||||
|
||||
.. bro:see:: http_begin_entity http_content_type http_end_entity http_entity_data
|
||||
http_event http_header http_message_done http_reply http_request http_stats
|
||||
http_connection_upgrade
|
||||
|
||||
.. note:: This event is also raised for headers found in nested body
|
||||
entities.
|
||||
|
||||
.. bro:id:: http_begin_entity
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated when starting to parse an HTTP body entity. This event is generated
|
||||
at least once for each non-empty (client or server) HTTP body; and
|
||||
potentially more than once if the body contains further nested MIME
|
||||
entities. Bro raises this event just before it starts parsing each entity's
|
||||
content.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the entity was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
.. bro:see:: http_all_headers http_content_type http_end_entity http_entity_data
|
||||
http_event http_header http_message_done http_reply http_request http_stats
|
||||
mime_begin_entity http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_connection_upgrade
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, protocol: :bro:type:`string`)
|
||||
|
||||
Generated when a HTTP session is upgraded to a different protocol (e.g. websocket).
|
||||
This event is raised when a server replies with a HTTP 101 reply. No more HTTP events
|
||||
will be raised after this event.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:protocol: The protocol to which the connection is switching.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_event http_header http_message_done http_reply
|
||||
http_request
|
||||
|
||||
.. bro:id:: http_content_type
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, ty: :bro:type:`string`, subty: :bro:type:`string`)
|
||||
|
||||
Generated for reporting an HTTP body's content type. This event is
|
||||
generated at the end of parsing an HTTP header, passing on the MIME
|
||||
type as specified by the ``Content-Type`` header. If that header is
|
||||
missing, this event is still raised with a default value of ``text/plain``.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the entity was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:ty: The main type.
|
||||
|
||||
|
||||
:subty: The subtype.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_end_entity http_entity_data
|
||||
http_event http_header http_message_done http_reply http_request http_stats
|
||||
http_connection_upgrade
|
||||
|
||||
.. note:: This event is also raised for headers found in nested body
|
||||
entities.
|
||||
|
||||
.. bro:id:: http_end_entity
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated when finishing parsing an HTTP body entity. This event is generated
|
||||
at least once for each non-empty (client or server) HTTP body; and
|
||||
potentially more than once if the body contains further nested MIME
|
||||
entities. Bro raises this event at the point when it has finished parsing an
|
||||
entity's content.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the entity was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_entity_data
|
||||
http_event http_header http_message_done http_reply http_request
|
||||
http_stats mime_end_entity http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_entity_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, length: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
Generated when parsing an HTTP body entity, passing on the data. This event
|
||||
can potentially be raised many times for each entity, each time passing a
|
||||
chunk of the data of not further defined size.
|
||||
|
||||
A common idiom for using this event is to first *reassemble* the data
|
||||
at the scripting layer by concatenating it to a successively growing
|
||||
string; and only perform further content analysis once the corresponding
|
||||
:bro:id:`http_end_entity` event has been raised. Note, however, that doing so
|
||||
can be quite expensive for HTTP tranders. At the very least, one should
|
||||
impose an upper size limit on how much data is being buffered.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the entity was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:length: The length of *data*.
|
||||
|
||||
|
||||
:data: One chunk of raw entity data.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_event http_header http_message_done http_reply http_request http_stats
|
||||
mime_entity_data http_entity_data_delivery_size skip_http_data
|
||||
http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_event
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, event_type: :bro:type:`string`, detail: :bro:type:`string`)
|
||||
|
||||
Generated for errors found when decoding HTTP requests or replies.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:event_type: A string describing the general category of the problem found
|
||||
(e.g., ``illegal format``).
|
||||
|
||||
|
||||
:detail: Further more detailed description of the error.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_header http_message_done http_reply http_request
|
||||
http_stats mime_event http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_header
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, name: :bro:type:`string`, value: :bro:type:`string`)
|
||||
|
||||
Generated for HTTP headers. Bro supports persistent and pipelined HTTP
|
||||
sessions and raises corresponding events as it parses client/server
|
||||
dialogues.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the header was sent by the originator of the TCP connection.
|
||||
|
||||
|
||||
:name: The name of the header.
|
||||
|
||||
|
||||
:value: The value of the header.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_event http_message_done http_reply http_request
|
||||
http_stats http_connection_upgrade
|
||||
|
||||
.. note:: This event is also raised for headers found in nested body
|
||||
entities.
|
||||
|
||||
.. bro:id:: http_message_done
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, stat: :bro:type:`http_message_stat`)
|
||||
|
||||
Generated once at the end of parsing an HTTP message. Bro supports persistent
|
||||
and pipelined HTTP sessions and raises corresponding events as it parses
|
||||
client/server dialogues. A "message" is one top-level HTTP entity, such as a
|
||||
complete request or reply. Each message can have further nested sub-entities
|
||||
inside. This event is raised once all sub-entities belonging to a top-level
|
||||
message have been processed (and their corresponding ``http_entity_*`` events
|
||||
generated).
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the entity was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:stat: Further meta information about the message.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_event http_header http_reply http_request http_stats
|
||||
http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, version: :bro:type:`string`, code: :bro:type:`count`, reason: :bro:type:`string`)
|
||||
|
||||
Generated for HTTP replies. Bro supports persistent and pipelined HTTP
|
||||
sessions and raises corresponding events as it parses client/server
|
||||
dialogues. This event is generated as soon as a reply's initial line has
|
||||
been parsed, and before any :bro:id:`http_header` events are raised.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:version: The version number specified in the reply (e.g., ``1.1``).
|
||||
|
||||
|
||||
:code: The numerical response code returned by the server.
|
||||
|
||||
|
||||
:reason: The textual description returned by the server along with *code*.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_event http_header http_message_done http_request
|
||||
http_stats http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, method: :bro:type:`string`, original_URI: :bro:type:`string`, unescaped_URI: :bro:type:`string`, version: :bro:type:`string`)
|
||||
|
||||
Generated for HTTP requests. Bro supports persistent and pipelined HTTP
|
||||
sessions and raises corresponding events as it parses client/server
|
||||
dialogues. This event is generated as soon as a request's initial line has
|
||||
been parsed, and before any :bro:id:`http_header` events are raised.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol>`__
|
||||
for more information about the HTTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:method: The HTTP method extracted from the request (e.g., ``GET``, ``POST``).
|
||||
|
||||
|
||||
:original_URI: The unprocessed URI as specified in the request.
|
||||
|
||||
|
||||
:unescaped_URI: The URI with all percent-encodings decoded.
|
||||
|
||||
|
||||
:version: The version number specified in the request (e.g., ``1.1``).
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_event http_header http_message_done http_reply http_stats
|
||||
truncate_http_URI http_connection_upgrade
|
||||
|
||||
.. bro:id:: http_stats
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, stats: :bro:type:`http_stats_rec`)
|
||||
|
||||
Generated at the end of an HTTP session to report statistics about it. This
|
||||
event is raised after all of an HTTP session's requests and replies have been
|
||||
fully processed.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:stats: Statistics summarizing HTTP-level properties of the finished
|
||||
connection.
|
||||
|
||||
.. bro:see:: http_all_headers http_begin_entity http_content_type http_end_entity
|
||||
http_entity_data http_event http_header http_message_done http_reply
|
||||
http_request http_connection_upgrade
|
||||
|
||||
|
||||
58
doc/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro.rst
Normal file
58
doc/scripts/base/bif/plugins/Bro_HTTP.functions.bif.bro.rst
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_HTTP.functions.bif.bro
|
||||
===========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
===================================================== ===============================================================
|
||||
:bro:id:`skip_http_entity_data`: :bro:type:`function` Skips the data of the HTTP entity.
|
||||
:bro:id:`unescape_URI`: :bro:type:`function` Unescapes all characters in a URI (decode every ``%xx`` group).
|
||||
===================================================== ===============================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: skip_http_entity_data
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`) : :bro:type:`any`
|
||||
|
||||
Skips the data of the HTTP entity.
|
||||
|
||||
|
||||
:c: The HTTP connection.
|
||||
|
||||
|
||||
:is_orig: If true, the client data is skipped, and the server data otherwise.
|
||||
|
||||
.. bro:see:: skip_smtp_data
|
||||
|
||||
.. bro:id:: unescape_URI
|
||||
|
||||
:Type: :bro:type:`function` (URI: :bro:type:`string`) : :bro:type:`string`
|
||||
|
||||
Unescapes all characters in a URI (decode every ``%xx`` group).
|
||||
|
||||
|
||||
:URI: The URI to unescape.
|
||||
|
||||
|
||||
:returns: The unescaped URI with all ``%xx`` groups decoded.
|
||||
|
||||
.. note::
|
||||
|
||||
Unescaping reserved characters may cause loss of information.
|
||||
:rfc:`2396`: A URI is always in an "escaped" form, since escaping or
|
||||
unescaping a completed URI might change its semantics. Normally, the
|
||||
only time escape encodings can safely be made is when the URI is
|
||||
being created from its component parts.
|
||||
|
||||
|
||||
459
doc/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro.rst
Normal file
459
doc/scripts/base/bif/plugins/Bro_ICMP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,459 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_ICMP.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================== ====================================================================
|
||||
:bro:id:`icmp_echo_reply`: :bro:type:`event` Generated for ICMP *echo reply* messages.
|
||||
:bro:id:`icmp_echo_request`: :bro:type:`event` Generated for ICMP *echo request* messages.
|
||||
:bro:id:`icmp_error_message`: :bro:type:`event` Generated for all ICMPv6 error messages that are not handled
|
||||
separately with dedicated events.
|
||||
:bro:id:`icmp_neighbor_advertisement`: :bro:type:`event` Generated for ICMP *neighbor advertisement* messages.
|
||||
:bro:id:`icmp_neighbor_solicitation`: :bro:type:`event` Generated for ICMP *neighbor solicitation* messages.
|
||||
:bro:id:`icmp_packet_too_big`: :bro:type:`event` Generated for ICMPv6 *packet too big* messages.
|
||||
:bro:id:`icmp_parameter_problem`: :bro:type:`event` Generated for ICMPv6 *parameter problem* messages.
|
||||
:bro:id:`icmp_redirect`: :bro:type:`event` Generated for ICMP *redirect* messages.
|
||||
:bro:id:`icmp_router_advertisement`: :bro:type:`event` Generated for ICMP *router advertisement* messages.
|
||||
:bro:id:`icmp_router_solicitation`: :bro:type:`event` Generated for ICMP *router solicitation* messages.
|
||||
:bro:id:`icmp_sent`: :bro:type:`event` Generated for all ICMP messages that are not handled separately with
|
||||
dedicated ICMP events.
|
||||
:bro:id:`icmp_sent_payload`: :bro:type:`event` The same as :bro:see:`icmp_sent` except containing the ICMP payload.
|
||||
:bro:id:`icmp_time_exceeded`: :bro:type:`event` Generated for ICMP *time exceeded* messages.
|
||||
:bro:id:`icmp_unreachable`: :bro:type:`event` Generated for ICMP *destination unreachable* messages.
|
||||
======================================================== ====================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: icmp_echo_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, id: :bro:type:`count`, seq: :bro:type:`count`, payload: :bro:type:`string`)
|
||||
|
||||
Generated for ICMP *echo reply* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:id: The *echo reply* identifier.
|
||||
|
||||
|
||||
:seq: The *echo reply* sequence number.
|
||||
|
||||
|
||||
:payload: The message-specific data of the packet payload, i.e., everything
|
||||
after the first 8 bytes of the ICMP header.
|
||||
|
||||
.. bro:see:: icmp_echo_request
|
||||
|
||||
.. bro:id:: icmp_echo_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, id: :bro:type:`count`, seq: :bro:type:`count`, payload: :bro:type:`string`)
|
||||
|
||||
Generated for ICMP *echo request* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard
|
||||
connection record *c*.
|
||||
|
||||
|
||||
:id: The *echo request* identifier.
|
||||
|
||||
|
||||
:seq: The *echo request* sequence number.
|
||||
|
||||
|
||||
:payload: The message-specific data of the packet payload, i.e., everything
|
||||
after the first 8 bytes of the ICMP header.
|
||||
|
||||
.. bro:see:: icmp_echo_reply
|
||||
|
||||
.. bro:id:: icmp_error_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, code: :bro:type:`count`, context: :bro:type:`icmp_context`)
|
||||
|
||||
Generated for all ICMPv6 error messages that are not handled
|
||||
separately with dedicated events. Bro's ICMP analyzer handles a number
|
||||
of ICMP error messages directly with dedicated events. This event acts
|
||||
as a fallback for those it doesn't.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/ICMPv6>`__ for more
|
||||
information about the ICMPv6 protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard
|
||||
connection record *c*.
|
||||
|
||||
|
||||
:code: The ICMP code of the error message.
|
||||
|
||||
|
||||
:context: A record with specifics of the original packet that the message
|
||||
refers to.
|
||||
|
||||
.. bro:see:: icmp_unreachable icmp_packet_too_big
|
||||
icmp_time_exceeded icmp_parameter_problem
|
||||
|
||||
.. bro:id:: icmp_neighbor_advertisement
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, router: :bro:type:`bool`, solicited: :bro:type:`bool`, override: :bro:type:`bool`, tgt: :bro:type:`addr`, options: :bro:type:`icmp6_nd_options`)
|
||||
|
||||
Generated for ICMP *neighbor advertisement* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:router: Flag indicating the sender is a router.
|
||||
|
||||
|
||||
:solicited: Flag indicating advertisement is in response to a solicitation.
|
||||
|
||||
|
||||
:override: Flag indicating advertisement should override existing caches.
|
||||
|
||||
|
||||
:tgt: the Target Address in the soliciting message or the address whose
|
||||
link-layer address has changed for unsolicited adverts.
|
||||
|
||||
|
||||
:options: Any Neighbor Discovery options included with message (:rfc:`4861`).
|
||||
|
||||
.. bro:see:: icmp_router_solicitation icmp_router_advertisement
|
||||
icmp_neighbor_solicitation icmp_redirect
|
||||
|
||||
.. bro:id:: icmp_neighbor_solicitation
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, tgt: :bro:type:`addr`, options: :bro:type:`icmp6_nd_options`)
|
||||
|
||||
Generated for ICMP *neighbor solicitation* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:tgt: The IP address of the target of the solicitation.
|
||||
|
||||
|
||||
:options: Any Neighbor Discovery options included with message (:rfc:`4861`).
|
||||
|
||||
.. bro:see:: icmp_router_solicitation icmp_router_advertisement
|
||||
icmp_neighbor_advertisement icmp_redirect
|
||||
|
||||
.. bro:id:: icmp_packet_too_big
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, code: :bro:type:`count`, context: :bro:type:`icmp_context`)
|
||||
|
||||
Generated for ICMPv6 *packet too big* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/ICMPv6>`__ for more
|
||||
information about the ICMPv6 protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:code: The ICMP code of the *too big* message.
|
||||
|
||||
|
||||
:context: A record with specifics of the original packet that the message
|
||||
refers to. *Too big* messages should include the original IP header
|
||||
from the packet that triggered them, and Bro parses that into
|
||||
the *context* structure. Note that if the *too big* includes only
|
||||
a partial IP header for some reason, no fields of *context* will
|
||||
be filled out.
|
||||
|
||||
.. bro:see:: icmp_error_message icmp_unreachable
|
||||
icmp_time_exceeded icmp_parameter_problem
|
||||
|
||||
.. bro:id:: icmp_parameter_problem
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, code: :bro:type:`count`, context: :bro:type:`icmp_context`)
|
||||
|
||||
Generated for ICMPv6 *parameter problem* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/ICMPv6>`__ for more
|
||||
information about the ICMPv6 protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:code: The ICMP code of the *parameter problem* message.
|
||||
|
||||
|
||||
:context: A record with specifics of the original packet that the message
|
||||
refers to. *Parameter problem* messages should include the original
|
||||
IP header from the packet that triggered them, and Bro parses that
|
||||
into the *context* structure. Note that if the *parameter problem*
|
||||
includes only a partial IP header for some reason, no fields
|
||||
of *context* will be filled out.
|
||||
|
||||
.. bro:see:: icmp_error_message icmp_unreachable icmp_packet_too_big
|
||||
icmp_time_exceeded
|
||||
|
||||
.. bro:id:: icmp_redirect
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, tgt: :bro:type:`addr`, dest: :bro:type:`addr`, options: :bro:type:`icmp6_nd_options`)
|
||||
|
||||
Generated for ICMP *redirect* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:tgt: The address that is supposed to be a better first hop to use for
|
||||
ICMP Destination Address.
|
||||
|
||||
|
||||
:dest: The address of the destination which is redirected to the target.
|
||||
|
||||
|
||||
:options: Any Neighbor Discovery options included with message (:rfc:`4861`).
|
||||
|
||||
.. bro:see:: icmp_router_solicitation icmp_router_advertisement
|
||||
icmp_neighbor_solicitation icmp_neighbor_advertisement
|
||||
|
||||
.. bro:id:: icmp_router_advertisement
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, cur_hop_limit: :bro:type:`count`, managed: :bro:type:`bool`, other: :bro:type:`bool`, home_agent: :bro:type:`bool`, pref: :bro:type:`count`, proxy: :bro:type:`bool`, rsv: :bro:type:`count`, router_lifetime: :bro:type:`interval`, reachable_time: :bro:type:`interval`, retrans_timer: :bro:type:`interval`, options: :bro:type:`icmp6_nd_options`)
|
||||
|
||||
Generated for ICMP *router advertisement* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:cur_hop_limit: The default value that should be placed in Hop Count field
|
||||
for outgoing IP packets.
|
||||
|
||||
|
||||
:managed: Managed address configuration flag, :rfc:`4861`.
|
||||
|
||||
|
||||
:other: Other stateful configuration flag, :rfc:`4861`.
|
||||
|
||||
|
||||
:home_agent: Mobile IPv6 home agent flag, :rfc:`3775`.
|
||||
|
||||
|
||||
:pref: Router selection preferences, :rfc:`4191`.
|
||||
|
||||
|
||||
:proxy: Neighbor discovery proxy flag, :rfc:`4389`.
|
||||
|
||||
|
||||
:rsv: Remaining two reserved bits of router advertisement flags.
|
||||
|
||||
|
||||
:router_lifetime: How long this router should be used as a default router.
|
||||
|
||||
|
||||
:reachable_time: How long a neighbor should be considered reachable.
|
||||
|
||||
|
||||
:retrans_timer: How long a host should wait before retransmitting.
|
||||
|
||||
|
||||
:options: Any Neighbor Discovery options included with message (:rfc:`4861`).
|
||||
|
||||
.. bro:see:: icmp_router_solicitation
|
||||
icmp_neighbor_solicitation icmp_neighbor_advertisement icmp_redirect
|
||||
|
||||
.. bro:id:: icmp_router_solicitation
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, options: :bro:type:`icmp6_nd_options`)
|
||||
|
||||
Generated for ICMP *router solicitation* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:options: Any Neighbor Discovery options included with message (:rfc:`4861`).
|
||||
|
||||
.. bro:see:: icmp_router_advertisement
|
||||
icmp_neighbor_solicitation icmp_neighbor_advertisement icmp_redirect
|
||||
|
||||
.. bro:id:: icmp_sent
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`)
|
||||
|
||||
Generated for all ICMP messages that are not handled separately with
|
||||
dedicated ICMP events. Bro's ICMP analyzer handles a number of ICMP messages
|
||||
directly with dedicated events. This event acts as a fallback for those it
|
||||
doesn't.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard
|
||||
connection record *c*.
|
||||
|
||||
.. bro:see:: icmp_error_message icmp_sent_payload
|
||||
|
||||
.. bro:id:: icmp_sent_payload
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, payload: :bro:type:`string`)
|
||||
|
||||
The same as :bro:see:`icmp_sent` except containing the ICMP payload.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard
|
||||
connection record *c*.
|
||||
|
||||
|
||||
:payload: The payload of the ICMP message.
|
||||
|
||||
.. bro:see:: icmp_error_message icmp_sent_payload
|
||||
|
||||
.. bro:id:: icmp_time_exceeded
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, code: :bro:type:`count`, context: :bro:type:`icmp_context`)
|
||||
|
||||
Generated for ICMP *time exceeded* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:code: The ICMP code of the *exceeded* message.
|
||||
|
||||
|
||||
:context: A record with specifics of the original packet that the message
|
||||
refers to. *Unreachable* messages should include the original IP
|
||||
header from the packet that triggered them, and Bro parses that
|
||||
into the *context* structure. Note that if the *exceeded* includes
|
||||
only a partial IP header for some reason, no fields of *context*
|
||||
will be filled out.
|
||||
|
||||
.. bro:see:: icmp_error_message icmp_unreachable icmp_packet_too_big
|
||||
icmp_parameter_problem
|
||||
|
||||
.. bro:id:: icmp_unreachable
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, icmp: :bro:type:`icmp_conn`, code: :bro:type:`count`, context: :bro:type:`icmp_context`)
|
||||
|
||||
Generated for ICMP *destination unreachable* messages.
|
||||
|
||||
See `Wikipedia
|
||||
<http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol>`__ for more
|
||||
information about the ICMP protocol.
|
||||
|
||||
|
||||
:c: The connection record for the corresponding ICMP flow.
|
||||
|
||||
|
||||
:icmp: Additional ICMP-specific information augmenting the standard connection
|
||||
record *c*.
|
||||
|
||||
|
||||
:code: The ICMP code of the *unreachable* message.
|
||||
|
||||
|
||||
:context: A record with specifics of the original packet that the message
|
||||
refers to. *Unreachable* messages should include the original IP
|
||||
header from the packet that triggered them, and Bro parses that
|
||||
into the *context* structure. Note that if the *unreachable*
|
||||
includes only a partial IP header for some reason, no
|
||||
fields of *context* will be filled out.
|
||||
|
||||
.. bro:see:: icmp_error_message icmp_packet_too_big
|
||||
icmp_time_exceeded icmp_parameter_problem
|
||||
|
||||
|
||||
49
doc/scripts/base/bif/plugins/Bro_IMAP.events.bif.bro.rst
Normal file
49
doc/scripts/base/bif/plugins/Bro_IMAP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_IMAP.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================== ==================================================================
|
||||
:bro:id:`imap_capabilities`: :bro:type:`event` Generated when a server sends a capability list to the client,
|
||||
after being queried using the CAPABILITY command.
|
||||
:bro:id:`imap_starttls`: :bro:type:`event` Generated when a IMAP connection goes encrypted after a successful
|
||||
StartTLS exchange between the client and the server.
|
||||
============================================== ==================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: imap_capabilities
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, capabilities: :bro:type:`string_vec`)
|
||||
|
||||
Generated when a server sends a capability list to the client,
|
||||
after being queried using the CAPABILITY command.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:capabilities: The list of IMAP capabilities as sent by the server.
|
||||
|
||||
.. bro:id:: imap_starttls
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated when a IMAP connection goes encrypted after a successful
|
||||
StartTLS exchange between the client and the server.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
1098
doc/scripts/base/bif/plugins/Bro_IRC.events.bif.bro.rst
Normal file
1098
doc/scripts/base/bif/plugins/Bro_IRC.events.bif.bro.rst
Normal file
File diff suppressed because it is too large
Load diff
109
doc/scripts/base/bif/plugins/Bro_Ident.events.bif.bro.rst
Normal file
109
doc/scripts/base/bif/plugins/Bro_Ident.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,109 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_Ident.events.bif.bro
|
||||
=========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================== ==================================
|
||||
:bro:id:`ident_error`: :bro:type:`event` Generated for Ident error replies.
|
||||
:bro:id:`ident_reply`: :bro:type:`event` Generated for Ident replies.
|
||||
:bro:id:`ident_request`: :bro:type:`event` Generated for Ident requests.
|
||||
========================================== ==================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ident_error
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, lport: :bro:type:`port`, rport: :bro:type:`port`, line: :bro:type:`string`)
|
||||
|
||||
Generated for Ident error replies.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/ident_protocol>`__ for more
|
||||
information about the Ident protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:lport: The corresponding request's local port.
|
||||
|
||||
|
||||
:rport: The corresponding request's remote port.
|
||||
|
||||
|
||||
:line: The error description returned by the reply.
|
||||
|
||||
.. bro:see:: ident_reply ident_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: ident_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, lport: :bro:type:`port`, rport: :bro:type:`port`, user_id: :bro:type:`string`, system: :bro:type:`string`)
|
||||
|
||||
Generated for Ident replies.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/ident_protocol>`__ for more
|
||||
information about the Ident protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:lport: The corresponding request's local port.
|
||||
|
||||
|
||||
:rport: The corresponding request's remote port.
|
||||
|
||||
|
||||
:user_id: The user id returned by the reply.
|
||||
|
||||
|
||||
:system: The operating system returned by the reply.
|
||||
|
||||
.. bro:see:: ident_error ident_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: ident_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, lport: :bro:type:`port`, rport: :bro:type:`port`)
|
||||
|
||||
Generated for Ident requests.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/ident_protocol>`__ for more
|
||||
information about the Ident protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:lport: The request's local port.
|
||||
|
||||
|
||||
:rport: The request's remote port.
|
||||
|
||||
.. bro:see:: ident_error ident_reply
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_InterConn.events.bif.bro
|
||||
=============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================== ===========
|
||||
:bro:id:`interconn_remove_conn`: :bro:type:`event` Deprecated.
|
||||
:bro:id:`interconn_stats`: :bro:type:`event` Deprecated.
|
||||
================================================== ===========
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: interconn_remove_conn
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
.. bro:id:: interconn_stats
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, os: :bro:type:`interconn_endp_stats`, rs: :bro:type:`interconn_endp_stats`)
|
||||
|
||||
Deprecated. Will be removed.
|
||||
|
||||
|
||||
250
doc/scripts/base/bif/plugins/Bro_KRB.events.bif.bro.rst
Normal file
250
doc/scripts/base/bif/plugins/Bro_KRB.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,250 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_KRB.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================= ==================================================================
|
||||
:bro:id:`krb_ap_request`: :bro:type:`event` A Kerberos 5 ``Authentication Header (AP) Request`` as defined
|
||||
in :rfc:`4120`.
|
||||
:bro:id:`krb_ap_response`: :bro:type:`event` A Kerberos 5 ``Authentication Header (AP) Response`` as defined
|
||||
in :rfc:`4120`.
|
||||
:bro:id:`krb_as_request`: :bro:type:`event` A Kerberos 5 ``Authentication Server (AS) Request`` as defined
|
||||
in :rfc:`4120`.
|
||||
:bro:id:`krb_as_response`: :bro:type:`event` A Kerberos 5 ``Authentication Server (AS) Response`` as defined
|
||||
in :rfc:`4120`.
|
||||
:bro:id:`krb_cred`: :bro:type:`event` A Kerberos 5 ``Credential Message`` as defined in :rfc:`4120`.
|
||||
:bro:id:`krb_error`: :bro:type:`event` A Kerberos 5 ``Error Message`` as defined in :rfc:`4120`.
|
||||
:bro:id:`krb_priv`: :bro:type:`event` A Kerberos 5 ``Private Message`` as defined in :rfc:`4120`.
|
||||
:bro:id:`krb_safe`: :bro:type:`event` A Kerberos 5 ``Safe Message`` as defined in :rfc:`4120`.
|
||||
:bro:id:`krb_tgs_request`: :bro:type:`event` A Kerberos 5 ``Ticket Granting Service (TGS) Request`` as defined
|
||||
in :rfc:`4120`.
|
||||
:bro:id:`krb_tgs_response`: :bro:type:`event` A Kerberos 5 ``Ticket Granting Service (TGS) Response`` as defined
|
||||
in :rfc:`4120`.
|
||||
============================================= ==================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: krb_ap_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, ticket: :bro:type:`KRB::Ticket`, opts: :bro:type:`KRB::AP_Options`)
|
||||
|
||||
A Kerberos 5 ``Authentication Header (AP) Request`` as defined
|
||||
in :rfc:`4120`. This message contains authentication information
|
||||
that should be part of the first message in an authenticated
|
||||
transaction.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:ticket: The Kerberos ticket being used for authentication.
|
||||
|
||||
|
||||
:opts: A Kerberos AP options data structure.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_tgs_response
|
||||
krb_ap_response krb_priv krb_safe krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_ap_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
A Kerberos 5 ``Authentication Header (AP) Response`` as defined
|
||||
in :rfc:`4120`. This is used if mutual authentication is desired.
|
||||
All of the interesting information in here is encrypted, so the event
|
||||
doesn't have much useful data, but it's provided in case it's important
|
||||
to know that this message was sent.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_tgs_response
|
||||
krb_ap_request krb_priv krb_safe krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_as_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`KRB::KDC_Request`)
|
||||
|
||||
A Kerberos 5 ``Authentication Server (AS) Request`` as defined
|
||||
in :rfc:`4120`. The AS request contains a username of the client
|
||||
requesting authentication, and returns an AS reply with an
|
||||
encrypted Ticket Granting Ticket (TGT) for that user. The TGT
|
||||
can then be used to request further tickets for other services.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:msg: A Kerberos KDC request message data structure.
|
||||
|
||||
.. bro:see:: krb_as_response krb_tgs_request krb_tgs_response krb_ap_request
|
||||
krb_ap_response krb_priv krb_safe krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_as_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`KRB::KDC_Response`)
|
||||
|
||||
A Kerberos 5 ``Authentication Server (AS) Response`` as defined
|
||||
in :rfc:`4120`. Following the AS request for a user, an AS reply
|
||||
contains an encrypted Ticket Granting Ticket (TGT) for that user.
|
||||
The TGT can then be used to request further tickets for other services.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:msg: A Kerberos KDC reply message data structure.
|
||||
|
||||
.. bro:see:: krb_as_request krb_tgs_request krb_tgs_response krb_ap_request
|
||||
krb_ap_response krb_priv krb_safe krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_cred
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, tickets: :bro:type:`KRB::Ticket_Vector`)
|
||||
|
||||
A Kerberos 5 ``Credential Message`` as defined in :rfc:`4120`. This is
|
||||
a private (encrypted) message to forward credentials.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:is_orig: Whether the originator of the connection sent this message.
|
||||
|
||||
|
||||
:tickets: Tickets obtained from the KDC that are being forwarded.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_tgs_response
|
||||
krb_ap_request krb_ap_response krb_priv krb_safe krb_error
|
||||
|
||||
.. bro:id:: krb_error
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`KRB::Error_Msg`)
|
||||
|
||||
A Kerberos 5 ``Error Message`` as defined in :rfc:`4120`.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:msg: A Kerberos error message data structure.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_tgs_response
|
||||
krb_ap_request krb_ap_response krb_priv krb_safe krb_cred
|
||||
|
||||
.. bro:id:: krb_priv
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
A Kerberos 5 ``Private Message`` as defined in :rfc:`4120`. This
|
||||
is a private (encrypted) application message, so the event doesn't
|
||||
have much useful data, but it's provided in case it's important to
|
||||
know that this message was sent.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:is_orig: Whether the originator of the connection sent this message.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_tgs_response
|
||||
krb_ap_request krb_ap_response krb_safe krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_safe
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`KRB::SAFE_Msg`)
|
||||
|
||||
A Kerberos 5 ``Safe Message`` as defined in :rfc:`4120`. This is a
|
||||
safe (checksummed) application message.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:is_orig: Whether the originator of the connection sent this message.
|
||||
|
||||
|
||||
:msg: A Kerberos SAFE message data structure.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_tgs_response
|
||||
krb_ap_request krb_ap_response krb_priv krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_tgs_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`KRB::KDC_Request`)
|
||||
|
||||
A Kerberos 5 ``Ticket Granting Service (TGS) Request`` as defined
|
||||
in :rfc:`4120`. Following the Authentication Server exchange, if
|
||||
successful, the client now has a Ticket Granting Ticket (TGT). To
|
||||
authenticate to a Kerberized service, the client requests a Service
|
||||
Ticket, which will be returned in the TGS reply.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:msg: A Kerberos KDC request message data structure.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_response krb_ap_request
|
||||
krb_ap_response krb_priv krb_safe krb_cred krb_error
|
||||
|
||||
.. bro:id:: krb_tgs_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`KRB::KDC_Response`)
|
||||
|
||||
A Kerberos 5 ``Ticket Granting Service (TGS) Response`` as defined
|
||||
in :rfc:`4120`. This message returns a Service Ticket to the client,
|
||||
which is encrypted with the service's long-term key, and which the
|
||||
client can use to authenticate to that service.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Kerberos_%28protocol%29>`__ for
|
||||
more information about the Kerberos protocol.
|
||||
|
||||
|
||||
:c: The connection over which this Kerberos message was sent.
|
||||
|
||||
|
||||
:msg: A Kerberos KDC reply message data structure.
|
||||
|
||||
.. bro:see:: krb_as_request krb_as_response krb_tgs_request krb_ap_request
|
||||
krb_ap_response krb_priv krb_safe krb_cred krb_error
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_KRB.types.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_KRB.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_KRB.types.bif.bro
|
||||
======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: KRB
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, KRB
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
547
doc/scripts/base/bif/plugins/Bro_Login.events.bif.bro.rst
Normal file
547
doc/scripts/base/bif/plugins/Bro_Login.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,547 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_Login.events.bif.bro
|
||||
=========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================== =========================================================================
|
||||
:bro:id:`activating_encryption`: :bro:type:`event` Generated for Telnet sessions when encryption is activated.
|
||||
:bro:id:`authentication_accepted`: :bro:type:`event` Generated when a Telnet authentication has been successful.
|
||||
:bro:id:`authentication_rejected`: :bro:type:`event` Generated when a Telnet authentication has been unsuccessful.
|
||||
:bro:id:`authentication_skipped`: :bro:type:`event` Generated for Telnet/Rlogin sessions when a pattern match indicates
|
||||
that no authentication is performed.
|
||||
:bro:id:`bad_option`: :bro:type:`event` Generated for an ill-formed or unrecognized Telnet option.
|
||||
:bro:id:`bad_option_termination`: :bro:type:`event` Generated for a Telnet option that's incorrectly terminated.
|
||||
:bro:id:`inconsistent_option`: :bro:type:`event` Generated for an inconsistent Telnet option.
|
||||
:bro:id:`login_confused`: :bro:type:`event` Generated when tracking of Telnet/Rlogin authentication failed.
|
||||
:bro:id:`login_confused_text`: :bro:type:`event` Generated after getting confused while tracking a Telnet/Rlogin
|
||||
authentication dialog.
|
||||
:bro:id:`login_display`: :bro:type:`event` Generated for clients transmitting an X11 DISPLAY in a Telnet session.
|
||||
:bro:id:`login_failure`: :bro:type:`event` Generated for Telnet/Rlogin login failures.
|
||||
:bro:id:`login_input_line`: :bro:type:`event` Generated for lines of input on Telnet/Rlogin sessions.
|
||||
:bro:id:`login_output_line`: :bro:type:`event` Generated for lines of output on Telnet/Rlogin sessions.
|
||||
:bro:id:`login_prompt`: :bro:type:`event` Generated for clients transmitting a terminal prompt in a Telnet session.
|
||||
:bro:id:`login_success`: :bro:type:`event` Generated for successful Telnet/Rlogin logins.
|
||||
:bro:id:`login_terminal`: :bro:type:`event` Generated for clients transmitting a terminal type in a Telnet session.
|
||||
:bro:id:`rsh_reply`: :bro:type:`event` Generated for client side commands on an RSH connection.
|
||||
:bro:id:`rsh_request`: :bro:type:`event` Generated for client side commands on an RSH connection.
|
||||
==================================================== =========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: activating_encryption
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for Telnet sessions when encryption is activated. The Telnet
|
||||
protocol includes options for negotiating encryption. When such a series of
|
||||
options is successfully negotiated, the event engine generates this event.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: authentication_accepted authentication_rejected authentication_skipped
|
||||
login_confused login_confused_text login_display login_failure login_input_line
|
||||
login_output_line login_prompt login_success login_terminal
|
||||
|
||||
.. bro:id:: authentication_accepted
|
||||
|
||||
:Type: :bro:type:`event` (name: :bro:type:`string`, c: :bro:type:`connection`)
|
||||
|
||||
Generated when a Telnet authentication has been successful. The Telnet
|
||||
protocol includes options for negotiating authentication. When such an
|
||||
option is sent from client to server and the server replies that it accepts
|
||||
the authentication, then the event engine generates this event.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:name: The authenticated name.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: authentication_rejected authentication_skipped login_success
|
||||
|
||||
.. note:: This event inspects the corresponding Telnet option
|
||||
while :bro:id:`login_success` heuristically determines success by watching
|
||||
session data.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: authentication_rejected
|
||||
|
||||
:Type: :bro:type:`event` (name: :bro:type:`string`, c: :bro:type:`connection`)
|
||||
|
||||
Generated when a Telnet authentication has been unsuccessful. The Telnet
|
||||
protocol includes options for negotiating authentication. When such an option
|
||||
is sent from client to server and the server replies that it did not accept
|
||||
the authentication, then the event engine generates this event.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:name: The attempted authentication name.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: authentication_accepted authentication_skipped login_failure
|
||||
|
||||
.. note:: This event inspects the corresponding Telnet option
|
||||
while :bro:id:`login_success` heuristically determines failure by watching
|
||||
session data.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: authentication_skipped
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for Telnet/Rlogin sessions when a pattern match indicates
|
||||
that no authentication is performed.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: authentication_accepted authentication_rejected direct_login_prompts
|
||||
get_login_state login_failure_msgs login_non_failure_msgs login_prompts
|
||||
login_success_msgs login_timeouts set_login_state
|
||||
|
||||
.. note:: The login analyzer depends on a set of script-level variables that
|
||||
need to be configured with patterns identifying activity. This
|
||||
configuration has not yet been ported over from Bro 1.5 to Bro 2.x, and
|
||||
the analyzer is therefore not directly usable at the moment.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: bad_option
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for an ill-formed or unrecognized Telnet option.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: inconsistent_option bad_option_termination authentication_accepted
|
||||
authentication_rejected authentication_skipped login_confused
|
||||
login_confused_text login_display login_failure login_input_line
|
||||
login_output_line login_prompt login_success login_terminal
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: bad_option_termination
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for a Telnet option that's incorrectly terminated.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: inconsistent_option bad_option authentication_accepted
|
||||
authentication_rejected authentication_skipped login_confused
|
||||
login_confused_text login_display login_failure login_input_line
|
||||
login_output_line login_prompt login_success login_terminal
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: inconsistent_option
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for an inconsistent Telnet option. Telnet options are specified
|
||||
by the client and server stating which options they are willing to
|
||||
support vs. which they are not, and then instructing one another which in
|
||||
fact they should or should not use for the current connection. If the event
|
||||
engine sees a peer violate either what the other peer has instructed it to
|
||||
do, or what it itself offered in terms of options in the past, then the
|
||||
engine generates this event.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: bad_option bad_option_termination authentication_accepted
|
||||
authentication_rejected authentication_skipped login_confused
|
||||
login_confused_text login_display login_failure login_input_line
|
||||
login_output_line login_prompt login_success login_terminal
|
||||
|
||||
.. bro:id:: login_confused
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`, line: :bro:type:`string`)
|
||||
|
||||
Generated when tracking of Telnet/Rlogin authentication failed. As Bro's
|
||||
*login* analyzer uses a number of heuristics to extract authentication
|
||||
information, it may become confused. If it can no longer correctly track
|
||||
the authentication dialog, it raises this event.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:msg: Gives the particular problem the heuristics detected (for example,
|
||||
``multiple_login_prompts`` means that the engine saw several login
|
||||
prompts in a row, without the type-ahead from the client side presumed
|
||||
necessary to cause them)
|
||||
|
||||
|
||||
:line: The line of text that caused the heuristics to conclude they were
|
||||
confused.
|
||||
|
||||
.. bro:see:: login_confused_text login_display login_failure login_input_line login_output_line
|
||||
login_prompt login_success login_terminal direct_login_prompts get_login_state
|
||||
login_failure_msgs login_non_failure_msgs login_prompts login_success_msgs
|
||||
login_timeouts set_login_state
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_confused_text
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, line: :bro:type:`string`)
|
||||
|
||||
Generated after getting confused while tracking a Telnet/Rlogin
|
||||
authentication dialog. The *login* analyzer generates this even for every
|
||||
line of user input after it has reported :bro:id:`login_confused` for a
|
||||
connection.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:line: The line the user typed.
|
||||
|
||||
.. bro:see:: login_confused login_display login_failure login_input_line
|
||||
login_output_line login_prompt login_success login_terminal direct_login_prompts
|
||||
get_login_state login_failure_msgs login_non_failure_msgs login_prompts
|
||||
login_success_msgs login_timeouts set_login_state
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_display
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, display: :bro:type:`string`)
|
||||
|
||||
Generated for clients transmitting an X11 DISPLAY in a Telnet session. This
|
||||
information is extracted out of environment variables sent as Telnet options.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:display: The DISPLAY transmitted.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_failure login_input_line
|
||||
login_output_line login_prompt login_success login_terminal
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_failure
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, user: :bro:type:`string`, client_user: :bro:type:`string`, password: :bro:type:`string`, line: :bro:type:`string`)
|
||||
|
||||
Generated for Telnet/Rlogin login failures. The *login* analyzer inspects
|
||||
Telnet/Rlogin sessions to heuristically extract username and password
|
||||
information as well as the text returned by the login server. This event is
|
||||
raised if a login attempt appears to have been unsuccessful.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:user: The user name tried.
|
||||
|
||||
|
||||
:client_user: For Telnet connections, this is an empty string, but for Rlogin
|
||||
connections, it is the client name passed in the initial authentication
|
||||
information (to check against .rhosts).
|
||||
|
||||
|
||||
:password: The password tried.
|
||||
|
||||
|
||||
:line: The line of text that led the analyzer to conclude that the
|
||||
authentication had failed.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_display login_input_line
|
||||
login_output_line login_prompt login_success login_terminal direct_login_prompts
|
||||
get_login_state login_failure_msgs login_non_failure_msgs login_prompts login_success_msgs
|
||||
login_timeouts set_login_state
|
||||
|
||||
.. note:: The login analyzer depends on a set of script-level variables that
|
||||
need to be configured with patterns identifying login attempts. This
|
||||
configuration has not yet been ported over from Bro 1.5 to Bro 2.x, and
|
||||
the analyzer is therefore not directly usable at the moment.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_input_line
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, line: :bro:type:`string`)
|
||||
|
||||
Generated for lines of input on Telnet/Rlogin sessions. The line will have
|
||||
control characters (such as in-band Telnet options) removed.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:line: The input line.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_display login_failure
|
||||
login_output_line login_prompt login_success login_terminal rsh_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_output_line
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, line: :bro:type:`string`)
|
||||
|
||||
Generated for lines of output on Telnet/Rlogin sessions. The line will have
|
||||
control characters (such as in-band Telnet options) removed.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:line: The ouput line.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_display login_failure
|
||||
login_input_line login_prompt login_success login_terminal rsh_reply
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_prompt
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, prompt: :bro:type:`string`)
|
||||
|
||||
Generated for clients transmitting a terminal prompt in a Telnet session.
|
||||
This information is extracted out of environment variables sent as Telnet
|
||||
options.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Telnet>`__ for more information
|
||||
about the Telnet protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:prompt: The TTYPROMPT transmitted.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_display login_failure
|
||||
login_input_line login_output_line login_success login_terminal
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_success
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, user: :bro:type:`string`, client_user: :bro:type:`string`, password: :bro:type:`string`, line: :bro:type:`string`)
|
||||
|
||||
Generated for successful Telnet/Rlogin logins. The *login* analyzer inspects
|
||||
Telnet/Rlogin sessions to heuristically extract username and password
|
||||
information as well as the text returned by the login server. This event is
|
||||
raised if a login attempt appears to have been successful.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:user: The user name used.
|
||||
|
||||
|
||||
:client_user: For Telnet connections, this is an empty string, but for Rlogin
|
||||
connections, it is the client name passed in the initial authentication
|
||||
information (to check against .rhosts).
|
||||
|
||||
|
||||
:password: The password used.
|
||||
|
||||
|
||||
:line: The line of text that led the analyzer to conclude that the
|
||||
authentication had succeeded.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_display login_failure
|
||||
login_input_line login_output_line login_prompt login_terminal
|
||||
direct_login_prompts get_login_state login_failure_msgs login_non_failure_msgs
|
||||
login_prompts login_success_msgs login_timeouts set_login_state
|
||||
|
||||
.. note:: The login analyzer depends on a set of script-level variables that
|
||||
need to be configured with patterns identifying login attempts. This
|
||||
configuration has not yet been ported over from Bro 1.5 to Bro 2.x, and
|
||||
the analyzer is therefore not directly usable at the moment.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: login_terminal
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, terminal: :bro:type:`string`)
|
||||
|
||||
Generated for clients transmitting a terminal type in a Telnet session. This
|
||||
information is extracted out of environment variables sent as Telnet options.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:terminal: The TERM value transmitted.
|
||||
|
||||
.. bro:see:: login_confused login_confused_text login_display login_failure
|
||||
login_input_line login_output_line login_prompt login_success
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to add a
|
||||
call to :bro:see:`Analyzer::register_for_ports` or a DPD payload
|
||||
signature.
|
||||
|
||||
.. bro:id:: rsh_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, client_user: :bro:type:`string`, server_user: :bro:type:`string`, line: :bro:type:`string`)
|
||||
|
||||
Generated for client side commands on an RSH connection.
|
||||
|
||||
See :rfc:`1258` for more information about the Rlogin/Rsh protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:client_user: The client-side user name as sent in the initial protocol
|
||||
handshake.
|
||||
|
||||
|
||||
:server_user: The server-side user name as sent in the initial protocol
|
||||
handshake.
|
||||
|
||||
|
||||
:line: The command line sent in the request.
|
||||
|
||||
.. bro:see:: rsh_request login_confused login_confused_text login_display
|
||||
login_failure login_input_line login_output_line login_prompt login_success
|
||||
login_terminal
|
||||
|
||||
.. note:: For historical reasons, these events are separate from the
|
||||
``login_`` events. Ideally, they would all be handled uniquely.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: rsh_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, client_user: :bro:type:`string`, server_user: :bro:type:`string`, line: :bro:type:`string`, new_session: :bro:type:`bool`)
|
||||
|
||||
Generated for client side commands on an RSH connection.
|
||||
|
||||
See :rfc:`1258` for more information about the Rlogin/Rsh protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:client_user: The client-side user name as sent in the initial protocol
|
||||
handshake.
|
||||
|
||||
|
||||
:server_user: The server-side user name as sent in the initial protocol
|
||||
handshake.
|
||||
|
||||
|
||||
:line: The command line sent in the request.
|
||||
|
||||
|
||||
:new_session: True if this is the first command of the Rsh session.
|
||||
|
||||
.. bro:see:: rsh_reply login_confused login_confused_text login_display
|
||||
login_failure login_input_line login_output_line login_prompt login_success
|
||||
login_terminal
|
||||
|
||||
.. note:: For historical reasons, these events are separate from the
|
||||
``login_`` events. Ideally, they would all be handled uniquely.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
69
doc/scripts/base/bif/plugins/Bro_Login.functions.bif.bro.rst
Normal file
69
doc/scripts/base/bif/plugins/Bro_Login.functions.bif.bro.rst
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_Login.functions.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
=============================================== ===================================================================
|
||||
:bro:id:`get_login_state`: :bro:type:`function` Returns the state of the given login (Telnet or Rlogin) connection.
|
||||
:bro:id:`set_login_state`: :bro:type:`function` Sets the login state of a connection with a login analyzer.
|
||||
=============================================== ===================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: get_login_state
|
||||
|
||||
:Type: :bro:type:`function` (cid: :bro:type:`conn_id`) : :bro:type:`count`
|
||||
|
||||
Returns the state of the given login (Telnet or Rlogin) connection.
|
||||
|
||||
|
||||
:cid: The connection ID.
|
||||
|
||||
|
||||
:returns: False if the connection is not active or is not tagged as a
|
||||
login analyzer. Otherwise the function returns the state, which can
|
||||
be one of:
|
||||
|
||||
- ``LOGIN_STATE_AUTHENTICATE``: The connection is in its
|
||||
initial authentication dialog.
|
||||
- ``LOGIN_STATE_LOGGED_IN``: The analyzer believes the user has
|
||||
successfully authenticated.
|
||||
- ``LOGIN_STATE_SKIP``: The analyzer has skipped any further
|
||||
processing of the connection.
|
||||
- ``LOGIN_STATE_CONFUSED``: The analyzer has concluded that it
|
||||
does not correctly know the state of the connection, and/or
|
||||
the username associated with it.
|
||||
|
||||
.. bro:see:: set_login_state
|
||||
|
||||
.. bro:id:: set_login_state
|
||||
|
||||
:Type: :bro:type:`function` (cid: :bro:type:`conn_id`, new_state: :bro:type:`count`) : :bro:type:`bool`
|
||||
|
||||
Sets the login state of a connection with a login analyzer.
|
||||
|
||||
|
||||
:cid: The connection ID.
|
||||
|
||||
|
||||
:new_state: The new state of the login analyzer. See
|
||||
:bro:id:`get_login_state` for possible values.
|
||||
|
||||
|
||||
:returns: Returns false if *cid* is not an active connection
|
||||
or is not tagged as a login analyzer, and true otherwise.
|
||||
|
||||
.. bro:see:: get_login_state
|
||||
|
||||
|
||||
280
doc/scripts/base/bif/plugins/Bro_MIME.events.bif.bro.rst
Normal file
280
doc/scripts/base/bif/plugins/Bro_MIME.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,280 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_MIME.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================== =============================================================================
|
||||
:bro:id:`mime_all_data`: :bro:type:`event` Generated for passing on all data decoded from a single email MIME
|
||||
message.
|
||||
:bro:id:`mime_all_headers`: :bro:type:`event` Generated for MIME headers extracted from email MIME entities, passing all
|
||||
headers at once.
|
||||
:bro:id:`mime_begin_entity`: :bro:type:`event` Generated when starting to parse an email MIME entity.
|
||||
:bro:id:`mime_content_hash`: :bro:type:`event` Generated for decoded MIME entities extracted from email messages, passing on
|
||||
their MD5 checksums.
|
||||
:bro:id:`mime_end_entity`: :bro:type:`event` Generated when finishing parsing an email MIME entity.
|
||||
:bro:id:`mime_entity_data`: :bro:type:`event` Generated for data decoded from an email MIME entity.
|
||||
:bro:id:`mime_event`: :bro:type:`event` Generated for errors found when decoding email MIME entities.
|
||||
:bro:id:`mime_one_header`: :bro:type:`event` Generated for individual MIME headers extracted from email MIME
|
||||
entities.
|
||||
:bro:id:`mime_segment_data`: :bro:type:`event` Generated for chunks of decoded MIME data from email MIME entities.
|
||||
============================================== =============================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: mime_all_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, length: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
Generated for passing on all data decoded from a single email MIME
|
||||
message. If an email message has more than one MIME entity, this event
|
||||
combines all their data into a single value for analysis. Note that because
|
||||
of the potentially significant buffering necessary, using this event can be
|
||||
expensive.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:length: The length of *data*.
|
||||
|
||||
|
||||
:data: The raw data of all MIME entities concatenated.
|
||||
|
||||
.. bro:see:: mime_all_headers mime_begin_entity mime_content_hash mime_end_entity
|
||||
mime_entity_data mime_event mime_one_header mime_segment_data
|
||||
|
||||
.. note:: While Bro also decodes MIME entities extracted from HTTP
|
||||
sessions, there's no corresponding event for that currently.
|
||||
|
||||
.. bro:id:: mime_all_headers
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hlist: :bro:type:`mime_header_list`)
|
||||
|
||||
Generated for MIME headers extracted from email MIME entities, passing all
|
||||
headers at once. MIME is a protocol-independent data format for encoding
|
||||
text and files, along with corresponding metadata, for transmission.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hlist: A *table* containing all headers extracted from the current entity.
|
||||
The table is indexed by the position of the header (1 for the first,
|
||||
2 for the second, etc.).
|
||||
|
||||
.. bro:see:: mime_all_data mime_begin_entity mime_content_hash mime_end_entity
|
||||
mime_entity_data mime_event mime_one_header mime_segment_data
|
||||
http_header http_all_headers
|
||||
|
||||
.. note:: Bro also extracts MIME headers from HTTP sessions. For those,
|
||||
however, it raises :bro:id:`http_header` instead.
|
||||
|
||||
.. bro:id:: mime_begin_entity
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated when starting to parse an email MIME entity. MIME is a
|
||||
protocol-independent data format for encoding text and files, along with
|
||||
corresponding metadata, for transmission. Bro raises this event when it
|
||||
begins parsing a MIME entity extracted from an email protocol.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_content_hash mime_end_entity
|
||||
mime_entity_data mime_event mime_one_header mime_segment_data smtp_data
|
||||
http_begin_entity
|
||||
|
||||
.. note:: Bro also extracts MIME entities from HTTP sessions. For those,
|
||||
however, it raises :bro:id:`http_begin_entity` instead.
|
||||
|
||||
.. bro:id:: mime_content_hash
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, content_len: :bro:type:`count`, hash_value: :bro:type:`string`)
|
||||
|
||||
Generated for decoded MIME entities extracted from email messages, passing on
|
||||
their MD5 checksums. Bro computes the MD5 over the complete decoded data of
|
||||
each MIME entity.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:content_len: The length of the entity being hashed.
|
||||
|
||||
|
||||
:hash_value: The MD5 hash.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_end_entity
|
||||
mime_entity_data mime_event mime_one_header mime_segment_data
|
||||
|
||||
.. note:: While Bro also decodes MIME entities extracted from HTTP
|
||||
sessions, there's no corresponding event for that currently.
|
||||
|
||||
.. bro:id:: mime_end_entity
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated when finishing parsing an email MIME entity. MIME is a
|
||||
protocol-independent data format for encoding text and files, along with
|
||||
corresponding metadata, for transmission. Bro raises this event when it
|
||||
finished parsing a MIME entity extracted from an email protocol.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_entity_data mime_event mime_one_header mime_segment_data smtp_data
|
||||
http_end_entity
|
||||
|
||||
.. note:: Bro also extracts MIME entities from HTTP sessions. For those,
|
||||
however, it raises :bro:id:`http_end_entity` instead.
|
||||
|
||||
.. bro:id:: mime_entity_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, length: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
Generated for data decoded from an email MIME entity. This event delivers
|
||||
the complete content of a single MIME entity with the quoted-printable and
|
||||
and base64 data decoded. In contrast, there is also :bro:id:`mime_segment_data`,
|
||||
which passes on a sequence of data chunks as they come in. While
|
||||
``mime_entity_data`` is more convenient to handle, ``mime_segment_data`` is
|
||||
more efficient as Bro does not need to buffer the data. Thus, if possible,
|
||||
the latter should be preferred.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:length: The length of *data*.
|
||||
|
||||
|
||||
:data: The raw data of the complete entity.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_event mime_one_header mime_segment_data
|
||||
|
||||
.. note:: While Bro also decodes MIME entities extracted from HTTP
|
||||
sessions, there's no corresponding event for that currently.
|
||||
|
||||
.. bro:id:: mime_event
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, event_type: :bro:type:`string`, detail: :bro:type:`string`)
|
||||
|
||||
Generated for errors found when decoding email MIME entities.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:event_type: A string describing the general category of the problem found
|
||||
(e.g., ``illegal format``).
|
||||
|
||||
|
||||
:detail: Further more detailed description of the error.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_entity_data mime_one_header mime_segment_data http_event
|
||||
|
||||
.. note:: Bro also extracts MIME headers from HTTP sessions. For those,
|
||||
however, it raises :bro:id:`http_event` instead.
|
||||
|
||||
.. bro:id:: mime_one_header
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, h: :bro:type:`mime_header_rec`)
|
||||
|
||||
Generated for individual MIME headers extracted from email MIME
|
||||
entities. MIME is a protocol-independent data format for encoding text and
|
||||
files, along with corresponding metadata, for transmission.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:h: The parsed MIME header.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_entity_data mime_event mime_segment_data
|
||||
http_header http_all_headers
|
||||
|
||||
.. note:: Bro also extracts MIME headers from HTTP sessions. For those,
|
||||
however, it raises :bro:id:`http_header` instead.
|
||||
|
||||
.. bro:id:: mime_segment_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, length: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
Generated for chunks of decoded MIME data from email MIME entities. MIME
|
||||
is a protocol-independent data format for encoding text and files, along with
|
||||
corresponding metadata, for transmission. As Bro parses the data of an
|
||||
entity, it raises a sequence of these events, each coming as soon as a new
|
||||
chunk of data is available. In contrast, there is also
|
||||
:bro:id:`mime_entity_data`, which passes all of an entities data at once
|
||||
in a single block. While the latter is more convenient to handle,
|
||||
``mime_segment_data`` is more efficient as Bro does not need to buffer
|
||||
the data. Thus, if possible, this event should be preferred.
|
||||
|
||||
Bro's MIME analyzer for emails currently supports SMTP and POP3. See
|
||||
`Wikipedia <http://en.wikipedia.org/wiki/MIME>`__ for more information
|
||||
about MIME.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:length: The length of *data*.
|
||||
|
||||
|
||||
:data: The raw data of one segment of the current entity.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_entity_data mime_event mime_one_header http_entity_data
|
||||
mime_segment_length mime_segment_overlap_length
|
||||
|
||||
.. note:: Bro also extracts MIME data from HTTP sessions. For those,
|
||||
however, it raises :bro:id:`http_entity_data` (sic!) instead.
|
||||
|
||||
|
||||
530
doc/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro.rst
Normal file
530
doc/scripts/base/bif/plugins/Bro_Modbus.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,530 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_Modbus.events.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================================== ======================================================================
|
||||
:bro:id:`modbus_exception`: :bro:type:`event` Generated for any Modbus exception message.
|
||||
:bro:id:`modbus_mask_write_register_request`: :bro:type:`event` Generated for a Modbus mask write register request.
|
||||
:bro:id:`modbus_mask_write_register_response`: :bro:type:`event` Generated for a Modbus mask write register request.
|
||||
:bro:id:`modbus_message`: :bro:type:`event` Generated for any Modbus message regardless if the particular function
|
||||
is further supported or not.
|
||||
:bro:id:`modbus_read_coils_request`: :bro:type:`event` Generated for a Modbus read coils request.
|
||||
:bro:id:`modbus_read_coils_response`: :bro:type:`event` Generated for a Modbus read coils response.
|
||||
:bro:id:`modbus_read_discrete_inputs_request`: :bro:type:`event` Generated for a Modbus read discrete inputs request.
|
||||
:bro:id:`modbus_read_discrete_inputs_response`: :bro:type:`event` Generated for a Modbus read discrete inputs response.
|
||||
:bro:id:`modbus_read_fifo_queue_request`: :bro:type:`event` Generated for a Modbus read FIFO queue request.
|
||||
:bro:id:`modbus_read_fifo_queue_response`: :bro:type:`event` Generated for a Modbus read FIFO queue response.
|
||||
:bro:id:`modbus_read_file_record_request`: :bro:type:`event` Generated for a Modbus read file record request.
|
||||
:bro:id:`modbus_read_file_record_response`: :bro:type:`event` Generated for a Modbus read file record response.
|
||||
:bro:id:`modbus_read_holding_registers_request`: :bro:type:`event` Generated for a Modbus read holding registers request.
|
||||
:bro:id:`modbus_read_holding_registers_response`: :bro:type:`event` Generated for a Modbus read holding registers response.
|
||||
:bro:id:`modbus_read_input_registers_request`: :bro:type:`event` Generated for a Modbus read input registers request.
|
||||
:bro:id:`modbus_read_input_registers_response`: :bro:type:`event` Generated for a Modbus read input registers response.
|
||||
:bro:id:`modbus_read_write_multiple_registers_request`: :bro:type:`event` Generated for a Modbus read/write multiple registers request.
|
||||
:bro:id:`modbus_read_write_multiple_registers_response`: :bro:type:`event` Generated for a Modbus read/write multiple registers response.
|
||||
:bro:id:`modbus_write_file_record_request`: :bro:type:`event` Generated for a Modbus write file record request.
|
||||
:bro:id:`modbus_write_file_record_response`: :bro:type:`event` Generated for a Modbus write file record response.
|
||||
:bro:id:`modbus_write_multiple_coils_request`: :bro:type:`event` Generated for a Modbus write multiple coils request.
|
||||
:bro:id:`modbus_write_multiple_coils_response`: :bro:type:`event` Generated for a Modbus write multiple coils response.
|
||||
:bro:id:`modbus_write_multiple_registers_request`: :bro:type:`event` Generated for a Modbus write multiple registers request.
|
||||
:bro:id:`modbus_write_multiple_registers_response`: :bro:type:`event` Generated for a Modbus write multiple registers response.
|
||||
:bro:id:`modbus_write_single_coil_request`: :bro:type:`event` Generated for a Modbus write single coil request.
|
||||
:bro:id:`modbus_write_single_coil_response`: :bro:type:`event` Generated for a Modbus write single coil response.
|
||||
:bro:id:`modbus_write_single_register_request`: :bro:type:`event` Generated for a Modbus write single register request.
|
||||
:bro:id:`modbus_write_single_register_response`: :bro:type:`event` Generated for a Modbus write single register response.
|
||||
========================================================================== ======================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: modbus_exception
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, code: :bro:type:`count`)
|
||||
|
||||
Generated for any Modbus exception message.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:code: The exception code.
|
||||
|
||||
.. bro:id:: modbus_mask_write_register_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, address: :bro:type:`count`, and_mask: :bro:type:`count`, or_mask: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus mask write register request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:address: The memory address of the register where the masks should be applied.
|
||||
|
||||
|
||||
:and_mask: The value of the logical AND mask to apply to the register.
|
||||
|
||||
|
||||
:or_mask: The value of the logical OR mask to apply to the register.
|
||||
|
||||
.. bro:id:: modbus_mask_write_register_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, address: :bro:type:`count`, and_mask: :bro:type:`count`, or_mask: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus mask write register request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:address: The memory address of the register where the masks were applied.
|
||||
|
||||
|
||||
:and_mask: The value of the logical AND mask applied register.
|
||||
|
||||
|
||||
:or_mask: The value of the logical OR mask applied to the register.
|
||||
|
||||
.. bro:id:: modbus_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for any Modbus message regardless if the particular function
|
||||
is further supported or not.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:is_orig: True if the event is raised for the originator side.
|
||||
|
||||
.. bro:id:: modbus_read_coils_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, quantity: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus read coils request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first coil to be read.
|
||||
|
||||
|
||||
:quantity: The number of coils to be read.
|
||||
|
||||
.. bro:id:: modbus_read_coils_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, coils: :bro:type:`ModbusCoils`)
|
||||
|
||||
Generated for a Modbus read coils response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:coils: The coil values returned from the device.
|
||||
|
||||
.. bro:id:: modbus_read_discrete_inputs_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, quantity: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus read discrete inputs request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first coil to be read.
|
||||
|
||||
|
||||
:quantity: The number of coils to be read.
|
||||
|
||||
.. bro:id:: modbus_read_discrete_inputs_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, coils: :bro:type:`ModbusCoils`)
|
||||
|
||||
Generated for a Modbus read discrete inputs response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:coils: The coil values returned from the device.
|
||||
|
||||
.. bro:id:: modbus_read_fifo_queue_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus read FIFO queue request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The address of the FIFO queue to read.
|
||||
|
||||
.. bro:id:: modbus_read_fifo_queue_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, fifos: :bro:type:`ModbusRegisters`)
|
||||
|
||||
Generated for a Modbus read FIFO queue response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:fifos: The register values read from the FIFO queue on the device.
|
||||
|
||||
.. bro:id:: modbus_read_file_record_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`)
|
||||
|
||||
Generated for a Modbus read file record request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
.. note: This event is incomplete. The information from the data structure
|
||||
is not yet passed through to the event.
|
||||
|
||||
.. bro:id:: modbus_read_file_record_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`)
|
||||
|
||||
Generated for a Modbus read file record response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
.. note: This event is incomplete. The information from the data structure
|
||||
is not yet passed through to the event.
|
||||
|
||||
.. bro:id:: modbus_read_holding_registers_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, quantity: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus read holding registers request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first register to be read.
|
||||
|
||||
|
||||
:quantity: The number of registers to be read.
|
||||
|
||||
.. bro:id:: modbus_read_holding_registers_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, registers: :bro:type:`ModbusRegisters`)
|
||||
|
||||
Generated for a Modbus read holding registers response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:registers: The register values returned from the device.
|
||||
|
||||
.. bro:id:: modbus_read_input_registers_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, quantity: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus read input registers request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first register to be read.
|
||||
|
||||
|
||||
:quantity: The number of registers to be read.
|
||||
|
||||
.. bro:id:: modbus_read_input_registers_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, registers: :bro:type:`ModbusRegisters`)
|
||||
|
||||
Generated for a Modbus read input registers response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:registers: The register values returned from the device.
|
||||
|
||||
.. bro:id:: modbus_read_write_multiple_registers_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, read_start_address: :bro:type:`count`, read_quantity: :bro:type:`count`, write_start_address: :bro:type:`count`, write_registers: :bro:type:`ModbusRegisters`)
|
||||
|
||||
Generated for a Modbus read/write multiple registers request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:read_start_address: The memory address of the first register to be read.
|
||||
|
||||
|
||||
:read_quantity: The number of registers to read.
|
||||
|
||||
|
||||
:write_start_address: The memory address of the first register to be written.
|
||||
|
||||
|
||||
:write_registers: The values to be written to the registers.
|
||||
|
||||
.. bro:id:: modbus_read_write_multiple_registers_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, written_registers: :bro:type:`ModbusRegisters`)
|
||||
|
||||
Generated for a Modbus read/write multiple registers response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:written_registers: The register values read from the registers specified in
|
||||
the request.
|
||||
|
||||
.. bro:id:: modbus_write_file_record_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`)
|
||||
|
||||
Generated for a Modbus write file record request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
.. note: This event is incomplete. The information from the data structure
|
||||
is not yet passed through to the event.
|
||||
|
||||
.. bro:id:: modbus_write_file_record_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`)
|
||||
|
||||
Generated for a Modbus write file record response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
.. note: This event is incomplete. The information from the data structure
|
||||
is not yet passed through to the event.
|
||||
|
||||
.. bro:id:: modbus_write_multiple_coils_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, coils: :bro:type:`ModbusCoils`)
|
||||
|
||||
Generated for a Modbus write multiple coils request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first coil to be written.
|
||||
|
||||
|
||||
:coils: The values to be written to the coils.
|
||||
|
||||
.. bro:id:: modbus_write_multiple_coils_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, quantity: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus write multiple coils response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first coil that was written.
|
||||
|
||||
|
||||
:quantity: The quantity of coils that were written.
|
||||
|
||||
.. bro:id:: modbus_write_multiple_registers_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, registers: :bro:type:`ModbusRegisters`)
|
||||
|
||||
Generated for a Modbus write multiple registers request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first register to be written.
|
||||
|
||||
|
||||
:registers: The values to be written to the registers.
|
||||
|
||||
.. bro:id:: modbus_write_multiple_registers_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, start_address: :bro:type:`count`, quantity: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus write multiple registers response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:start_address: The memory address of the first register that was written.
|
||||
|
||||
|
||||
:quantity: The quantity of registers that were written.
|
||||
|
||||
.. bro:id:: modbus_write_single_coil_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, address: :bro:type:`count`, value: :bro:type:`bool`)
|
||||
|
||||
Generated for a Modbus write single coil request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:address: The memory address of the coil to be written.
|
||||
|
||||
|
||||
:value: The value to be written to the coil.
|
||||
|
||||
.. bro:id:: modbus_write_single_coil_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, address: :bro:type:`count`, value: :bro:type:`bool`)
|
||||
|
||||
Generated for a Modbus write single coil response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:address: The memory address of the coil that was written.
|
||||
|
||||
|
||||
:value: The value that was written to the coil.
|
||||
|
||||
.. bro:id:: modbus_write_single_register_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, address: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus write single register request.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:address: The memory address of the register to be written.
|
||||
|
||||
|
||||
:value: The value to be written to the register.
|
||||
|
||||
.. bro:id:: modbus_write_single_register_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, headers: :bro:type:`ModbusHeaders`, address: :bro:type:`count`, value: :bro:type:`count`)
|
||||
|
||||
Generated for a Modbus write single register response.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:headers: The headers for the modbus function.
|
||||
|
||||
|
||||
:address: The memory address of the register that was written.
|
||||
|
||||
|
||||
:value: The value that was written to the register.
|
||||
|
||||
|
||||
138
doc/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro.rst
Normal file
138
doc/scripts/base/bif/plugins/Bro_MySQL.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_MySQL.events.bif.bro
|
||||
=========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================== ======================================================================================================
|
||||
:bro:id:`mysql_command_request`: :bro:type:`event` Generated for a command request from a MySQL client.
|
||||
:bro:id:`mysql_error`: :bro:type:`event` Generated for an unsuccessful MySQL response.
|
||||
:bro:id:`mysql_handshake`: :bro:type:`event` Generated for a client handshake response packet, which includes the username the client is attempting
|
||||
to connect as.
|
||||
:bro:id:`mysql_ok`: :bro:type:`event` Generated for a successful MySQL response.
|
||||
:bro:id:`mysql_result_row`: :bro:type:`event` Generated for each MySQL ResultsetRow response packet.
|
||||
:bro:id:`mysql_server_version`: :bro:type:`event` Generated for the initial server handshake packet, which includes the MySQL server version.
|
||||
================================================== ======================================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: mysql_command_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, command: :bro:type:`count`, arg: :bro:type:`string`)
|
||||
|
||||
Generated for a command request from a MySQL client.
|
||||
|
||||
See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
|
||||
for more information about the MySQL protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:command: The numerical code of the command issued.
|
||||
|
||||
|
||||
:arg: The argument for the command (empty string if not provided).
|
||||
|
||||
.. bro:see:: mysql_error mysql_ok mysql_server_version mysql_handshake
|
||||
|
||||
.. bro:id:: mysql_error
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, code: :bro:type:`count`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for an unsuccessful MySQL response.
|
||||
|
||||
See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
|
||||
for more information about the MySQL protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:code: The error code.
|
||||
|
||||
|
||||
:msg: Any extra details about the error (empty string if not provided).
|
||||
|
||||
.. bro:see:: mysql_command_request mysql_ok mysql_server_version mysql_handshake
|
||||
|
||||
.. bro:id:: mysql_handshake
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, username: :bro:type:`string`)
|
||||
|
||||
Generated for a client handshake response packet, which includes the username the client is attempting
|
||||
to connect as.
|
||||
|
||||
See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
|
||||
for more information about the MySQL protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:username: The username supplied by the client
|
||||
|
||||
.. bro:see:: mysql_command_request mysql_error mysql_ok mysql_server_version
|
||||
|
||||
.. bro:id:: mysql_ok
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, affected_rows: :bro:type:`count`)
|
||||
|
||||
Generated for a successful MySQL response.
|
||||
|
||||
See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
|
||||
for more information about the MySQL protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:affected_rows: The number of rows that were affected.
|
||||
|
||||
.. bro:see:: mysql_command_request mysql_error mysql_server_version mysql_handshake
|
||||
|
||||
.. bro:id:: mysql_result_row
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, row: :bro:type:`string_vec`)
|
||||
|
||||
Generated for each MySQL ResultsetRow response packet.
|
||||
|
||||
See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
|
||||
for more information about the MySQL protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:row: The result row data.
|
||||
|
||||
.. bro:see:: mysql_command_request mysql_error mysql_server_version mysql_handshake mysql_ok
|
||||
|
||||
.. bro:id:: mysql_server_version
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, ver: :bro:type:`string`)
|
||||
|
||||
Generated for the initial server handshake packet, which includes the MySQL server version.
|
||||
|
||||
See the MySQL `documentation <http://dev.mysql.com/doc/internals/en/client-server-protocol.html>`__
|
||||
for more information about the MySQL protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:ver: The server version string.
|
||||
|
||||
.. bro:see:: mysql_command_request mysql_error mysql_ok mysql_handshake
|
||||
|
||||
|
||||
15
doc/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro.rst
Normal file
15
doc/scripts/base/bif/plugins/Bro_NCP.consts.bif.bro.rst
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NCP.consts.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
86
doc/scripts/base/bif/plugins/Bro_NCP.events.bif.bro.rst
Normal file
86
doc/scripts/base/bif/plugins/Bro_NCP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NCP.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================== ===================================================
|
||||
:bro:id:`ncp_reply`: :bro:type:`event` Generated for NCP replies (Netware Core Protocol).
|
||||
:bro:id:`ncp_request`: :bro:type:`event` Generated for NCP requests (Netware Core Protocol).
|
||||
======================================== ===================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ncp_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, frame_type: :bro:type:`count`, length: :bro:type:`count`, req_frame: :bro:type:`count`, req_func: :bro:type:`count`, completion_code: :bro:type:`count`)
|
||||
|
||||
Generated for NCP replies (Netware Core Protocol).
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for
|
||||
more information about the NCP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:frame_type: The frame type, as specified by the protocol.
|
||||
|
||||
|
||||
:length: The length of the request body, excluding the frame header.
|
||||
|
||||
|
||||
:req_frame: The frame type from the corresponding request.
|
||||
|
||||
|
||||
:req_func: The function code from the corresponding request.
|
||||
|
||||
|
||||
:completion_code: The reply's completion code, as specified by the protocol.
|
||||
|
||||
.. bro:see:: ncp_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: ncp_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, frame_type: :bro:type:`count`, length: :bro:type:`count`, func: :bro:type:`count`)
|
||||
|
||||
Generated for NCP requests (Netware Core Protocol).
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetWare_Core_Protocol>`__ for
|
||||
more information about the NCP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:frame_type: The frame type, as specified by the protocol.
|
||||
|
||||
|
||||
:length: The length of the request body, excluding the frame header.
|
||||
|
||||
|
||||
:func: The requested function, as specified by the protocol.
|
||||
|
||||
.. bro:see:: ncp_reply
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
67
doc/scripts/base/bif/plugins/Bro_NTLM.events.bif.bro.rst
Normal file
67
doc/scripts/base/bif/plugins/Bro_NTLM.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NTLM.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================== ============================================================================
|
||||
:bro:id:`ntlm_authenticate`: :bro:type:`event` Generated for :abbr:`NTLM (NT LAN Manager)` messages of type *authenticate*.
|
||||
:bro:id:`ntlm_challenge`: :bro:type:`event` Generated for :abbr:`NTLM (NT LAN Manager)` messages of type *challenge*.
|
||||
:bro:id:`ntlm_negotiate`: :bro:type:`event` Generated for :abbr:`NTLM (NT LAN Manager)` messages of type *negotiate*.
|
||||
============================================== ============================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ntlm_authenticate
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, request: :bro:type:`NTLM::Authenticate`)
|
||||
|
||||
Generated for :abbr:`NTLM (NT LAN Manager)` messages of type *authenticate*.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:request: The parsed data of the :abbr:`NTLM (NT LAN Manager)` message. See init-bare for more details.
|
||||
|
||||
.. bro:see:: ntlm_negotiate ntlm_challenge
|
||||
|
||||
.. bro:id:: ntlm_challenge
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, challenge: :bro:type:`NTLM::Challenge`)
|
||||
|
||||
Generated for :abbr:`NTLM (NT LAN Manager)` messages of type *challenge*.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:negotiate: The parsed data of the :abbr:`NTLM (NT LAN Manager)` message. See init-bare for more details.
|
||||
|
||||
.. bro:see:: ntlm_negotiate ntlm_authenticate
|
||||
|
||||
.. bro:id:: ntlm_negotiate
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, negotiate: :bro:type:`NTLM::Negotiate`)
|
||||
|
||||
Generated for :abbr:`NTLM (NT LAN Manager)` messages of type *negotiate*.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:negotiate: The parsed data of the :abbr:`NTLM (NT LAN Manager)` message. See init-bare for more details.
|
||||
|
||||
.. bro:see:: ntlm_challenge ntlm_authenticate
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_NTLM.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NTLM.types.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: NTLM
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, NTLM
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
50
doc/scripts/base/bif/plugins/Bro_NTP.events.bif.bro.rst
Normal file
50
doc/scripts/base/bif/plugins/Bro_NTP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NTP.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================== ===============================
|
||||
:bro:id:`ntp_message`: :bro:type:`event` Generated for all NTP messages.
|
||||
======================================== ===============================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ntp_message
|
||||
|
||||
:Type: :bro:type:`event` (u: :bro:type:`connection`, msg: :bro:type:`ntp_msg`, excess: :bro:type:`string`)
|
||||
|
||||
Generated for all NTP messages. Different from many other of Bro's events,
|
||||
this one is generated for both client-side and server-side messages.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Network_Time_Protocol>`__ for
|
||||
more information about the NTP protocol.
|
||||
|
||||
|
||||
:u: The connection record describing the corresponding UDP flow.
|
||||
|
||||
|
||||
:msg: The parsed NTP message.
|
||||
|
||||
|
||||
:excess: The raw bytes of any optional parts of the NTP packet. Bro does not
|
||||
further parse any optional fields.
|
||||
|
||||
.. bro:see:: ntp_session_timeout
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
277
doc/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro.rst
Normal file
277
doc/scripts/base/bif/plugins/Bro_NetBIOS.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,277 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NetBIOS.events.bif.bro
|
||||
===========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================= =====================================================================
|
||||
:bro:id:`netbios_session_accepted`: :bro:type:`event` Generated for NetBIOS messages of type *positive session response*.
|
||||
:bro:id:`netbios_session_keepalive`: :bro:type:`event` Generated for NetBIOS messages of type *keep-alive*.
|
||||
:bro:id:`netbios_session_message`: :bro:type:`event` Generated for all NetBIOS SSN and DGM messages.
|
||||
:bro:id:`netbios_session_raw_message`: :bro:type:`event` Generated for NetBIOS messages of type *session message* that are not
|
||||
carrying an SMB payload.
|
||||
:bro:id:`netbios_session_rejected`: :bro:type:`event` Generated for NetBIOS messages of type *negative session response*.
|
||||
:bro:id:`netbios_session_request`: :bro:type:`event` Generated for NetBIOS messages of type *session request*.
|
||||
:bro:id:`netbios_session_ret_arg_resp`: :bro:type:`event` Generated for NetBIOS messages of type *retarget response*.
|
||||
========================================================= =====================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: netbios_session_accepted
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for NetBIOS messages of type *positive session response*. Bro's
|
||||
NetBIOS analyzer processes the NetBIOS session service running on TCP port
|
||||
139, and (despite its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:msg: The raw payload of the message sent, excluding the common NetBIOS
|
||||
header.
|
||||
|
||||
.. bro:see:: netbios_session_keepalive netbios_session_message
|
||||
netbios_session_raw_message netbios_session_rejected netbios_session_request
|
||||
netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: netbios_session_keepalive
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for NetBIOS messages of type *keep-alive*. Bro's NetBIOS analyzer
|
||||
processes the NetBIOS session service running on TCP port 139, and (despite
|
||||
its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:msg: The raw payload of the message sent, excluding the common NetBIOS
|
||||
header.
|
||||
|
||||
.. bro:see:: netbios_session_accepted netbios_session_message
|
||||
netbios_session_raw_message netbios_session_rejected netbios_session_request
|
||||
netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: netbios_session_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg_type: :bro:type:`count`, data_len: :bro:type:`count`)
|
||||
|
||||
Generated for all NetBIOS SSN and DGM messages. Bro's NetBIOS analyzer
|
||||
processes the NetBIOS session service running on TCP port 139, and (despite
|
||||
its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:is_orig: True if the message was sent by the originator of the connection.
|
||||
|
||||
|
||||
:msg_type: The general type of message, as defined in Section 4.3.1 of
|
||||
:rfc:`1002`.
|
||||
|
||||
|
||||
:data_len: The length of the message's payload.
|
||||
|
||||
.. bro:see:: netbios_session_accepted netbios_session_keepalive
|
||||
netbios_session_raw_message netbios_session_rejected netbios_session_request
|
||||
netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: netbios_session_raw_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for NetBIOS messages of type *session message* that are not
|
||||
carrying an SMB payload.
|
||||
|
||||
NetBIOS analyzer processes the NetBIOS session service running on TCP port
|
||||
139, and (despite its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:is_orig: True if the message was sent by the originator of the connection.
|
||||
|
||||
|
||||
:msg: The raw payload of the message sent, excluding the common NetBIOS
|
||||
header (i.e., the ``user_data``).
|
||||
|
||||
.. bro:see:: netbios_session_accepted netbios_session_keepalive
|
||||
netbios_session_message netbios_session_rejected netbios_session_request
|
||||
netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: This is an oddly named event. In fact, it's probably an odd event
|
||||
to have to begin with.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: netbios_session_rejected
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for NetBIOS messages of type *negative session response*. Bro's
|
||||
NetBIOS analyzer processes the NetBIOS session service running on TCP port
|
||||
139, and (despite its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:msg: The raw payload of the message sent, excluding the common NetBIOS
|
||||
header.
|
||||
|
||||
.. bro:see:: netbios_session_accepted netbios_session_keepalive
|
||||
netbios_session_message netbios_session_raw_message netbios_session_request
|
||||
netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: netbios_session_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for NetBIOS messages of type *session request*. Bro's NetBIOS
|
||||
analyzer processes the NetBIOS session service running on TCP port 139, and
|
||||
(despite its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:msg: The raw payload of the message sent, excluding the common NetBIOS
|
||||
header.
|
||||
|
||||
.. bro:see:: netbios_session_accepted netbios_session_keepalive
|
||||
netbios_session_message netbios_session_raw_message netbios_session_rejected
|
||||
netbios_session_ret_arg_resp decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: netbios_session_ret_arg_resp
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for NetBIOS messages of type *retarget response*. Bro's NetBIOS
|
||||
analyzer processes the NetBIOS session service running on TCP port 139, and
|
||||
(despite its name!) the NetBIOS datagram service on UDP port 138.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/NetBIOS>`__ for more information
|
||||
about NetBIOS. :rfc:`1002` describes
|
||||
the packet format for NetBIOS over TCP/IP, which Bro parses.
|
||||
|
||||
|
||||
:c: The connection, which may be TCP or UDP, depending on the type of the
|
||||
NetBIOS session.
|
||||
|
||||
|
||||
:msg: The raw payload of the message sent, excluding the common NetBIOS
|
||||
header.
|
||||
|
||||
.. bro:see:: netbios_session_accepted netbios_session_keepalive
|
||||
netbios_session_message netbios_session_raw_message netbios_session_rejected
|
||||
netbios_session_request decode_netbios_name decode_netbios_name_type
|
||||
|
||||
.. note:: These days, NetBIOS is primarily used as a transport mechanism for
|
||||
`SMB/CIFS <http://en.wikipedia.org/wiki/Server_Message_Block>`__. Bro's
|
||||
SMB analyzer parses both SMB-over-NetBIOS and SMB-over-TCP on port 445.
|
||||
|
||||
.. todo:: This is an oddly named event.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NetBIOS.functions.bif.bro
|
||||
==============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
======================================================== ================================================================
|
||||
:bro:id:`decode_netbios_name`: :bro:type:`function` Decode a NetBIOS name.
|
||||
:bro:id:`decode_netbios_name_type`: :bro:type:`function` Converts a NetBIOS name type to its corresponding numeric value.
|
||||
======================================================== ================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: decode_netbios_name
|
||||
|
||||
:Type: :bro:type:`function` (name: :bro:type:`string`) : :bro:type:`string`
|
||||
|
||||
Decode a NetBIOS name. See http://support.microsoft.com/kb/194203.
|
||||
|
||||
|
||||
:name: The encoded NetBIOS name, e.g., ``"FEEIEFCAEOEFFEECEJEPFDCAEOEBENEF"``.
|
||||
|
||||
|
||||
:returns: The decoded NetBIOS name, e.g., ``"THE NETBIOS NAME"``.
|
||||
|
||||
.. bro:see:: decode_netbios_name_type
|
||||
|
||||
.. bro:id:: decode_netbios_name_type
|
||||
|
||||
:Type: :bro:type:`function` (name: :bro:type:`string`) : :bro:type:`count`
|
||||
|
||||
Converts a NetBIOS name type to its corresponding numeric value.
|
||||
See http://support.microsoft.com/kb/163409.
|
||||
|
||||
|
||||
:name: The NetBIOS name type.
|
||||
|
||||
|
||||
:returns: The numeric value of *name*.
|
||||
|
||||
.. bro:see:: decode_netbios_name
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_NoneWriter.none.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_NoneWriter.none.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_NoneWriter.none.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: LogNone
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, LogNone
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
110
doc/scripts/base/bif/plugins/Bro_PE.events.bif.bro.rst
Normal file
110
doc/scripts/base/bif/plugins/Bro_PE.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,110 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_PE.events.bif.bro
|
||||
======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=============================================== ===================================================================
|
||||
:bro:id:`pe_dos_code`: :bro:type:`event` A :abbr:`PE (Portable Executable)` file DOS stub was parsed.
|
||||
:bro:id:`pe_dos_header`: :bro:type:`event` A :abbr:`PE (Portable Executable)` file DOS header was parsed.
|
||||
:bro:id:`pe_file_header`: :bro:type:`event` A :abbr:`PE (Portable Executable)` file file header was parsed.
|
||||
:bro:id:`pe_optional_header`: :bro:type:`event` A :abbr:`PE (Portable Executable)` file optional header was parsed.
|
||||
:bro:id:`pe_section_header`: :bro:type:`event` A :abbr:`PE (Portable Executable)` file section header was parsed.
|
||||
=============================================== ===================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: pe_dos_code
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, code: :bro:type:`string`)
|
||||
|
||||
A :abbr:`PE (Portable Executable)` file DOS stub was parsed.
|
||||
The stub is a valid application that runs under MS-DOS, by default
|
||||
to inform the user that the program can't be run in DOS mode.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:code: The DOS stub
|
||||
|
||||
.. bro:see:: pe_dos_header pe_file_header pe_optional_header pe_section_header
|
||||
|
||||
.. bro:id:: pe_dos_header
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, h: :bro:type:`PE::DOSHeader`)
|
||||
|
||||
A :abbr:`PE (Portable Executable)` file DOS header was parsed.
|
||||
This is the top-level header and contains information like the
|
||||
size of the file, initial value of registers, etc.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:h: The parsed DOS header information.
|
||||
|
||||
.. bro:see:: pe_dos_code pe_file_header pe_optional_header pe_section_header
|
||||
|
||||
.. bro:id:: pe_file_header
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, h: :bro:type:`PE::FileHeader`)
|
||||
|
||||
A :abbr:`PE (Portable Executable)` file file header was parsed.
|
||||
This header contains information like the target machine,
|
||||
the timestamp when the file was created, the number of sections, and
|
||||
pointers to other parts of the file.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:h: The parsed file header information.
|
||||
|
||||
.. bro:see:: pe_dos_header pe_dos_code pe_optional_header pe_section_header
|
||||
|
||||
.. bro:id:: pe_optional_header
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, h: :bro:type:`PE::OptionalHeader`)
|
||||
|
||||
A :abbr:`PE (Portable Executable)` file optional header was parsed.
|
||||
This header is required for executable files, but not for object files.
|
||||
It contains information like OS requirements to execute the file, the
|
||||
original entry point address, and information needed to load the file
|
||||
into memory.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:h: The parsed optional header information.
|
||||
|
||||
.. bro:see:: pe_dos_header pe_dos_code pe_file_header pe_section_header
|
||||
|
||||
.. bro:id:: pe_section_header
|
||||
|
||||
:Type: :bro:type:`event` (f: :bro:type:`fa_file`, h: :bro:type:`PE::SectionHeader`)
|
||||
|
||||
A :abbr:`PE (Portable Executable)` file section header was parsed.
|
||||
This header contains information like the section name, size, address,
|
||||
and characteristics.
|
||||
|
||||
|
||||
:f: The file.
|
||||
|
||||
|
||||
:h: The parsed section header information.
|
||||
|
||||
.. bro:see:: pe_dos_header pe_dos_code pe_file_header pe_optional_header
|
||||
|
||||
|
||||
234
doc/scripts/base/bif/plugins/Bro_POP3.events.bif.bro.rst
Normal file
234
doc/scripts/base/bif/plugins/Bro_POP3.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,234 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_POP3.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=============================================== ===================================================================
|
||||
:bro:id:`pop3_data`: :bro:type:`event` Generated for server-side multi-line responses on POP3 connections.
|
||||
:bro:id:`pop3_login_failure`: :bro:type:`event` Generated for unsuccessful authentications on POP3 connections.
|
||||
:bro:id:`pop3_login_success`: :bro:type:`event` Generated for successful authentications on POP3 connections.
|
||||
:bro:id:`pop3_reply`: :bro:type:`event` Generated for server-side replies to commands on POP3 connections.
|
||||
:bro:id:`pop3_request`: :bro:type:`event` Generated for client-side commands on POP3 connections.
|
||||
:bro:id:`pop3_starttls`: :bro:type:`event` Generated when a POP3 connection goes encrypted.
|
||||
:bro:id:`pop3_unexpected`: :bro:type:`event` Generated for errors encountered on POP3 sessions.
|
||||
=============================================== ===================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: pop3_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, data: :bro:type:`string`)
|
||||
|
||||
Generated for server-side multi-line responses on POP3 connections. POP3
|
||||
connections use multi-line responses to send bulk data, such as the actual
|
||||
mails. This event is generated once for each line that's part of such a
|
||||
response.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the data was sent by the originator of the TCP connection.
|
||||
|
||||
|
||||
:data: The data sent.
|
||||
|
||||
.. bro:see:: pop3_login_failure pop3_login_success pop3_reply pop3_request
|
||||
pop3_unexpected
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: pop3_login_failure
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, user: :bro:type:`string`, password: :bro:type:`string`)
|
||||
|
||||
Generated for unsuccessful authentications on POP3 connections.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Always false.
|
||||
|
||||
|
||||
:user: The user name attempted for authentication. The event is only
|
||||
generated if a non-empty user name was used.
|
||||
|
||||
|
||||
:password: The password attempted for authentication.
|
||||
|
||||
.. bro:see:: pop3_data pop3_login_success pop3_reply pop3_request
|
||||
pop3_unexpected
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: pop3_login_success
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, user: :bro:type:`string`, password: :bro:type:`string`)
|
||||
|
||||
Generated for successful authentications on POP3 connections.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Always false.
|
||||
|
||||
|
||||
:user: The user name used for authentication. The event is only generated if
|
||||
a non-empty user name was used.
|
||||
|
||||
|
||||
:password: The password used for authentication.
|
||||
|
||||
.. bro:see:: pop3_data pop3_login_failure pop3_reply pop3_request
|
||||
pop3_unexpected
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: pop3_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, cmd: :bro:type:`string`, msg: :bro:type:`string`)
|
||||
|
||||
Generated for server-side replies to commands on POP3 connections.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the command was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:cmd: The success indicator sent by the server. This corresponds to the
|
||||
first token on the line sent, and should be either ``OK`` or ``ERR``.
|
||||
|
||||
|
||||
:msg: The textual description the server sent along with *cmd*.
|
||||
|
||||
.. bro:see:: pop3_data pop3_login_failure pop3_login_success pop3_request
|
||||
pop3_unexpected
|
||||
|
||||
.. todo:: This event is receiving odd parameters, should unify.
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: pop3_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, command: :bro:type:`string`, arg: :bro:type:`string`)
|
||||
|
||||
Generated for client-side commands on POP3 connections.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the command was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:command: The command sent.
|
||||
|
||||
|
||||
:arg: The argument to the command.
|
||||
|
||||
.. bro:see:: pop3_data pop3_login_failure pop3_login_success pop3_reply
|
||||
pop3_unexpected
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: pop3_starttls
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated when a POP3 connection goes encrypted. While POP3 is by default a
|
||||
clear-text protocol, extensions exist to switch to encryption. This event is
|
||||
generated if that happens and the analyzer then stops processing the
|
||||
connection.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
.. bro:see:: pop3_data pop3_login_failure pop3_login_success pop3_reply
|
||||
pop3_request pop3_unexpected
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
.. bro:id:: pop3_unexpected
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`string`, detail: :bro:type:`string`)
|
||||
|
||||
Generated for errors encountered on POP3 sessions. If the POP3 analyzer
|
||||
finds state transitions that do not conform to the protocol specification,
|
||||
or other situations it can't handle, it raises this event.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/POP3>`__ for more information
|
||||
about the POP3 protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the data was sent by the originator of the TCP connection.
|
||||
|
||||
|
||||
:msg: A textual description of the situation.
|
||||
|
||||
|
||||
:detail: The input that triggered the event.
|
||||
|
||||
.. bro:see:: pop3_data pop3_login_failure pop3_login_success pop3_reply pop3_request
|
||||
|
||||
.. todo:: Bro's current default configuration does not activate the protocol
|
||||
analyzer that generates this event; the corresponding script has not yet
|
||||
been ported to Bro 2.x. To still enable this event, one needs to
|
||||
register a port for it or add a DPD payload signature.
|
||||
|
||||
|
||||
59
doc/scripts/base/bif/plugins/Bro_RADIUS.events.bif.bro.rst
Normal file
59
doc/scripts/base/bif/plugins/Bro_RADIUS.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_RADIUS.events.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================= ====================================
|
||||
:bro:id:`radius_attribute`: :bro:type:`event` Generated for each RADIUS attribute.
|
||||
:bro:id:`radius_message`: :bro:type:`event` Generated for RADIUS messages.
|
||||
============================================= ====================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: radius_attribute
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, attr_type: :bro:type:`count`, value: :bro:type:`string`)
|
||||
|
||||
Generated for each RADIUS attribute.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more
|
||||
information about RADIUS.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:attr_type: The value of the code field (1 == User-Name, 2 == User-Password, etc.).
|
||||
|
||||
|
||||
:value: The data/value bound to the attribute.
|
||||
|
||||
|
||||
.. bro:id:: radius_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, result: :bro:type:`RADIUS::Message`)
|
||||
|
||||
Generated for RADIUS messages.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more
|
||||
information about RADIUS.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:result: A record containing fields parsed from a RADIUS packet.
|
||||
|
||||
|
||||
|
||||
134
doc/scripts/base/bif/plugins/Bro_RDP.events.bif.bro.rst
Normal file
134
doc/scripts/base/bif/plugins/Bro_RDP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_RDP.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=========================================================== ================================================
|
||||
:bro:id:`rdp_begin_encryption`: :bro:type:`event` Generated when an RDP session becomes encrypted.
|
||||
:bro:id:`rdp_client_core_data`: :bro:type:`event` Generated for MCS client requests.
|
||||
:bro:id:`rdp_connect_request`: :bro:type:`event` Generated for X.224 client requests.
|
||||
:bro:id:`rdp_gcc_server_create_response`: :bro:type:`event` Generated for MCS server responses.
|
||||
:bro:id:`rdp_negotiation_failure`: :bro:type:`event` Generated for RDP Negotiation Failure messages.
|
||||
:bro:id:`rdp_negotiation_response`: :bro:type:`event` Generated for RDP Negotiation Response messages.
|
||||
:bro:id:`rdp_server_certificate`: :bro:type:`event` Generated for a server certificate section.
|
||||
:bro:id:`rdp_server_security`: :bro:type:`event` Generated for MCS server responses.
|
||||
=========================================================== ================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: rdp_begin_encryption
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, security_protocol: :bro:type:`count`)
|
||||
|
||||
Generated when an RDP session becomes encrypted.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:security_protocol: The security protocol being used for the session.
|
||||
|
||||
.. bro:id:: rdp_client_core_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, data: :bro:type:`RDP::ClientCoreData`)
|
||||
|
||||
Generated for MCS client requests.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:data: The data contained in the client core data structure.
|
||||
|
||||
.. bro:id:: rdp_connect_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, cookie: :bro:type:`string`)
|
||||
|
||||
Generated for X.224 client requests.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:cookie: The cookie included in the request.
|
||||
|
||||
.. bro:id:: rdp_gcc_server_create_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, result: :bro:type:`count`)
|
||||
|
||||
Generated for MCS server responses.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:result: The 8-bit integer representing the GCC Conference Create Response result.
|
||||
|
||||
.. bro:id:: rdp_negotiation_failure
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, failure_code: :bro:type:`count`)
|
||||
|
||||
Generated for RDP Negotiation Failure messages.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:failure_code: The failure code sent by the server.
|
||||
|
||||
.. bro:id:: rdp_negotiation_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, security_protocol: :bro:type:`count`)
|
||||
|
||||
Generated for RDP Negotiation Response messages.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:security_protocol: The security protocol selected by the server.
|
||||
|
||||
.. bro:id:: rdp_server_certificate
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, cert_type: :bro:type:`count`, permanently_issued: :bro:type:`bool`)
|
||||
|
||||
Generated for a server certificate section. If multiple X.509
|
||||
certificates are included in chain, this event will still
|
||||
only be generated a single time.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:cert_type: Indicates the type of certificate.
|
||||
|
||||
|
||||
:permanently_issued: Value will be true is the certificate(s) is permanent on the server.
|
||||
|
||||
.. bro:id:: rdp_server_security
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, encryption_method: :bro:type:`count`, encryption_level: :bro:type:`count`)
|
||||
|
||||
Generated for MCS server responses.
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:encryption_method: The 32-bit integer representing the encryption method used in the connection.
|
||||
|
||||
|
||||
:encryption_level: The 32-bit integer representing the encryption level used in the connection.
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_RDP.types.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_RDP.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_RDP.types.bif.bro
|
||||
======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: RDP
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, RDP
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
116
doc/scripts/base/bif/plugins/Bro_RFB.events.bif.bro.rst
Normal file
116
doc/scripts/base/bif/plugins/Bro_RFB.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_RFB.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================== ==========================================================
|
||||
:bro:id:`rfb_auth_result`: :bro:type:`event` Generated for RFB event authentication result message
|
||||
:bro:id:`rfb_authentication_type`: :bro:type:`event` Generated for RFB event authentication mechanism selection
|
||||
:bro:id:`rfb_client_version`: :bro:type:`event` Generated for RFB event client banner message
|
||||
:bro:id:`rfb_event`: :bro:type:`event` Generated for RFB event
|
||||
:bro:id:`rfb_server_parameters`: :bro:type:`event` Generated for RFB event server parameter message
|
||||
:bro:id:`rfb_server_version`: :bro:type:`event` Generated for RFB event server banner message
|
||||
:bro:id:`rfb_share_flag`: :bro:type:`event` Generated for RFB event share flag messages
|
||||
==================================================== ==========================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: rfb_auth_result
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, result: :bro:type:`bool`)
|
||||
|
||||
Generated for RFB event authentication result message
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:result: whether or not authentication was succesful
|
||||
|
||||
.. bro:id:: rfb_authentication_type
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, authtype: :bro:type:`count`)
|
||||
|
||||
Generated for RFB event authentication mechanism selection
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:authtype: the value of the chosen authentication mechanism
|
||||
|
||||
.. bro:id:: rfb_client_version
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, major_version: :bro:type:`string`, minor_version: :bro:type:`string`)
|
||||
|
||||
Generated for RFB event client banner message
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:version: of the client's rfb library
|
||||
|
||||
.. bro:id:: rfb_event
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for RFB event
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
.. bro:id:: rfb_server_parameters
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, name: :bro:type:`string`, width: :bro:type:`count`, height: :bro:type:`count`)
|
||||
|
||||
Generated for RFB event server parameter message
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:name: name of the shared screen
|
||||
|
||||
|
||||
:width: width of the shared screen
|
||||
|
||||
|
||||
:height: height of the shared screen
|
||||
|
||||
.. bro:id:: rfb_server_version
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, major_version: :bro:type:`string`, minor_version: :bro:type:`string`)
|
||||
|
||||
Generated for RFB event server banner message
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:version: of the server's rfb library
|
||||
|
||||
.. bro:id:: rfb_share_flag
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, flag: :bro:type:`bool`)
|
||||
|
||||
Generated for RFB event share flag messages
|
||||
|
||||
|
||||
:c: The connection record for the underlying transport-layer session/flow.
|
||||
|
||||
|
||||
:flag: whether or not the share flag was set
|
||||
|
||||
|
||||
1281
doc/scripts/base/bif/plugins/Bro_RPC.events.bif.bro.rst
Normal file
1281
doc/scripts/base/bif/plugins/Bro_RPC.events.bif.bro.rst
Normal file
File diff suppressed because it is too large
Load diff
16
doc/scripts/base/bif/plugins/Bro_RawReader.raw.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_RawReader.raw.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_RawReader.raw.bif.bro
|
||||
==========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: InputRaw
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, InputRaw
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
157
doc/scripts/base/bif/plugins/Bro_SIP.events.bif.bro.rst
Normal file
157
doc/scripts/base/bif/plugins/Bro_SIP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,157 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SIP.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================= ==========================================================================================================
|
||||
:bro:id:`sip_all_headers`: :bro:type:`event` Generated once for all :abbr:`SIP (Session Initiation Protocol)` headers from the originator or responder.
|
||||
:bro:id:`sip_begin_entity`: :bro:type:`event` Generated at the beginning of a :abbr:`SIP (Session Initiation Protocol)` message.
|
||||
:bro:id:`sip_end_entity`: :bro:type:`event` Generated at the end of a :abbr:`SIP (Session Initiation Protocol)` message.
|
||||
:bro:id:`sip_header`: :bro:type:`event` Generated for each :abbr:`SIP (Session Initiation Protocol)` header.
|
||||
:bro:id:`sip_reply`: :bro:type:`event` Generated for :abbr:`SIP (Session Initiation Protocol)` replies, used in Voice over IP (VoIP).
|
||||
:bro:id:`sip_request`: :bro:type:`event` Generated for :abbr:`SIP (Session Initiation Protocol)` requests, used in Voice over IP (VoIP).
|
||||
============================================= ==========================================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: sip_all_headers
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, hlist: :bro:type:`mime_header_list`)
|
||||
|
||||
Generated once for all :abbr:`SIP (Session Initiation Protocol)` headers from the originator or responder.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
|
||||
for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Whether the headers came from the originator.
|
||||
|
||||
|
||||
:hlist: All the headers, and their values
|
||||
|
||||
.. bro:see:: sip_request sip_reply sip_header sip_begin_entity sip_end_entity
|
||||
|
||||
.. bro:id:: sip_begin_entity
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated at the beginning of a :abbr:`SIP (Session Initiation Protocol)` message.
|
||||
|
||||
This event is generated as soon as a message's initial line has been parsed.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
|
||||
for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Whether the message came from the originator.
|
||||
|
||||
.. bro:see:: sip_request sip_reply sip_header sip_all_headers sip_end_entity
|
||||
|
||||
.. bro:id:: sip_end_entity
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated at the end of a :abbr:`SIP (Session Initiation Protocol)` message.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
|
||||
for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Whether the message came from the originator.
|
||||
|
||||
.. bro:see:: sip_request sip_reply sip_header sip_all_headers sip_begin_entity
|
||||
|
||||
.. bro:id:: sip_header
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, name: :bro:type:`string`, value: :bro:type:`string`)
|
||||
|
||||
Generated for each :abbr:`SIP (Session Initiation Protocol)` header.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
|
||||
for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Whether the header came from the originator.
|
||||
|
||||
|
||||
:name: Header name.
|
||||
|
||||
|
||||
:value: Header value.
|
||||
|
||||
.. bro:see:: sip_request sip_reply sip_all_headers sip_begin_entity sip_end_entity
|
||||
|
||||
.. bro:id:: sip_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, version: :bro:type:`string`, code: :bro:type:`count`, reason: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SIP (Session Initiation Protocol)` replies, used in Voice over IP (VoIP).
|
||||
|
||||
This event is generated as soon as a reply's initial line has been parsed.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
|
||||
for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:version: The :abbr:`SIP (Session Initiation Protocol)` version in use.
|
||||
|
||||
|
||||
:code: The response code.
|
||||
|
||||
|
||||
:reason: Textual details for the response code.
|
||||
|
||||
.. bro:see:: sip_request sip_header sip_all_headers sip_begin_entity sip_end_entity
|
||||
|
||||
.. bro:id:: sip_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, method: :bro:type:`string`, original_URI: :bro:type:`string`, version: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SIP (Session Initiation Protocol)` requests, used in Voice over IP (VoIP).
|
||||
|
||||
This event is generated as soon as a request's initial line has been parsed.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Session_Initiation_Protocol>`__
|
||||
for more information about the :abbr:`SIP (Session Initiation Protocol)` protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:method: The :abbr:`SIP (Session Initiation Protocol)` method extracted from the request (e.g., ``REGISTER``, ``NOTIFY``).
|
||||
|
||||
|
||||
:original_URI: The unprocessed URI as specified in the request.
|
||||
|
||||
|
||||
:version: The version number specified in the request (e.g., ``2.0``).
|
||||
|
||||
.. bro:see:: sip_reply sip_header sip_all_headers sip_begin_entity sip_end_entity
|
||||
|
||||
|
||||
15
doc/scripts/base/bif/plugins/Bro_SMB.consts.bif.bro.rst
Normal file
15
doc/scripts/base/bif/plugins/Bro_SMB.consts.bif.bro.rst
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.consts.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
39
doc/scripts/base/bif/plugins/Bro_SMB.events.bif.bro.rst
Normal file
39
doc/scripts/base/bif/plugins/Bro_SMB.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================= ===================================================================
|
||||
:bro:id:`smb_pipe_connect_heuristic`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)` connections when a
|
||||
named pipe has been detected heuristically.
|
||||
======================================================= ===================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb_pipe_connect_heuristic
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)` connections when a
|
||||
named pipe has been detected heuristically. The case when this comes
|
||||
up is when the drive mapping isn't seen so the analyzer is not able
|
||||
to determine whether to send the data to the files framework or to
|
||||
the DCE_RPC analyzer. This heuristic can be tuned by adding or
|
||||
removing "named pipe" names from the :bro:see:`SMB::pipe_filenames`
|
||||
const.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_check_directory.bif.bro
|
||||
=========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================== ===========================================================================================
|
||||
:bro:id:`smb1_check_directory_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *check directory*.
|
||||
:bro:id:`smb1_check_directory_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *check directory*.
|
||||
========================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_check_directory_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, directory_name: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *check directory*. This is used by the client to verify that
|
||||
a specified path resolves to a valid directory on the server.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.17
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:directory_name: The directory name to check for existence.
|
||||
|
||||
.. bro:see:: smb1_message smb1_check_directory_response
|
||||
|
||||
.. bro:id:: smb1_check_directory_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *check directory*. This is the server response to the
|
||||
*check directory* request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.17
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
.. bro:see:: smb1_message smb1_check_directory_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_close.bif.bro
|
||||
===============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=============================================== ===========================================================================================
|
||||
:bro:id:`smb1_close_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *close*.
|
||||
=============================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_close_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_id: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *close*. This is used by the client to close an instance of an object
|
||||
associated with a valid file ID.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.5
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:file_id: The file identifier being closed.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_create_directory.bif.bro
|
||||
==========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=========================================================== ===========================================================================================
|
||||
:bro:id:`smb1_create_directory_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *create directory*.
|
||||
:bro:id:`smb1_create_directory_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *create directory*.
|
||||
=========================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_create_directory_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, directory_name: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *create directory*. This is a deprecated command which
|
||||
has been replaced by the *trans2_create_directory* subcommand. This is used by the client to
|
||||
create a new directory on the server, relative to a connected share.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.1
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:directory_name: The name of the directory to create.
|
||||
|
||||
.. bro:see:: smb1_message smb1_create_directory_response smb1_transaction2_request
|
||||
|
||||
.. bro:id:: smb1_create_directory_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *create directory*. This is a deprecated command which
|
||||
has been replaced by the *trans2_create_directory* subcommand. This is the server response
|
||||
to the *create directory* request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.1
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
.. bro:see:: smb1_message smb1_create_directory_request smb1_transaction2_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_echo.bif.bro
|
||||
==============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=============================================== ===========================================================================================
|
||||
:bro:id:`smb1_echo_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *echo*.
|
||||
:bro:id:`smb1_echo_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *echo*.
|
||||
=============================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_echo_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, echo_count: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *echo*. This is sent by the client to test the transport layer
|
||||
connection with the server.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.39
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:echo_count: The number of times the server should echo the data back.
|
||||
|
||||
|
||||
:data: The data for the server to echo.
|
||||
|
||||
.. bro:see:: smb1_message smb1_echo_response
|
||||
|
||||
.. bro:id:: smb1_echo_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, seq_num: :bro:type:`count`, data: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *echo*. This is the server response to the *echo* request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.39
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:seq_num: The sequence number of this echo reply.
|
||||
|
||||
|
||||
:data: The data echoed back from the client.
|
||||
|
||||
.. bro:see:: smb1_message smb1_echo_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_logoff_andx.bif.bro
|
||||
=====================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================= ===========================================================================================
|
||||
:bro:id:`smb1_logoff_andx`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *logoff andx*.
|
||||
============================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_logoff_andx
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *logoff andx*. This is used by the client to logoff the user
|
||||
connection represented by UID in the SMB Header. The server releases all locks and closes
|
||||
all files currently open by this user, disconnects all tree connects, cancels any outstanding
|
||||
requests for this UID, and invalidates the UID.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.54
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: Indicates which host sent the logoff message.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_negotiate.bif.bro
|
||||
===================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================== ===========================================================================================
|
||||
:bro:id:`smb1_negotiate_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *negotiate*.
|
||||
:bro:id:`smb1_negotiate_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *negotiate*.
|
||||
==================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_negotiate_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, dialects: :bro:type:`string_vec`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *negotiate*. This is sent by the client to initiate an SMB
|
||||
connection between the client and the server. A *negotiate* exchange MUST be completed
|
||||
before any other SMB messages are sent to the server.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.52
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:dialects: The SMB dialects supported by the client.
|
||||
|
||||
.. bro:see:: smb1_message smb1_negotiate_response
|
||||
|
||||
.. bro:id:: smb1_negotiate_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, response: :bro:type:`SMB1::NegotiateResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *negotiate*. This is the server response to the *negotiate*
|
||||
request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.52
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:response: A record structure containing more information from the response.
|
||||
|
||||
.. bro:see:: smb1_message smb1_negotiate_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_nt_cancel.bif.bro
|
||||
===================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=================================================== ===========================================================================================
|
||||
:bro:id:`smb1_nt_cancel_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *nt cancel*.
|
||||
=================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_nt_cancel_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *nt cancel*. This is sent by the client to request that a currently
|
||||
pending request be cancelled.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.65
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_nt_create_andx.bif.bro
|
||||
========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================= ===========================================================================================
|
||||
:bro:id:`smb1_nt_create_andx_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *nt create andx*.
|
||||
:bro:id:`smb1_nt_create_andx_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *nt create andx*.
|
||||
========================================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_nt_create_andx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_name: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *nt create andx*. This is sent by the client to create and open
|
||||
a new file, or to open an existing file, or to open and truncate an existing file to zero
|
||||
length, or to create a directory, or to create a connection to a named pipe.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.64
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:name: The ``name`` attribute specified in the message.
|
||||
|
||||
.. bro:see:: smb1_message smb1_nt_create_andx_response
|
||||
|
||||
.. bro:id:: smb1_nt_create_andx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_id: :bro:type:`count`, file_size: :bro:type:`count`, times: :bro:type:`SMB::MACTimes`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *nt create andx*. This is the server response to the
|
||||
*nt create andx* request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.64
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:file_id: The SMB2 GUID for the file.
|
||||
|
||||
|
||||
:file_size: Size of the file.
|
||||
|
||||
|
||||
:times: Timestamps associated with the file in question.
|
||||
|
||||
.. bro:see:: smb1_message smb1_nt_create_andx_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_query_information.bif.bro
|
||||
===========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=========================================================== ===========================================================================================
|
||||
:bro:id:`smb1_query_information_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *query information*.
|
||||
=========================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_query_information_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, filename: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *query information*. This is a deprecated command which
|
||||
has been replaced by the *trans2_query_path_information* subcommand. This is used by the
|
||||
client to obtain attribute information about a file.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.9
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:filename: The filename that the client is querying.
|
||||
|
||||
.. bro:see:: smb1_message smb1_transaction2_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_read_andx.bif.bro
|
||||
===================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================== ===========================================================================================
|
||||
:bro:id:`smb1_read_andx_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *read andx*.
|
||||
:bro:id:`smb1_read_andx_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *read andx*.
|
||||
==================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_read_andx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_id: :bro:type:`count`, offset: :bro:type:`count`, length: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *read andx*. This is sent by the client to read bytes from a regular
|
||||
file, a named pipe, or a directly accessible device such as a serial port (COM) or printer
|
||||
port (LPT).
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.42
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:file_id: The file identifier being written to.
|
||||
|
||||
|
||||
:offset: The byte offset the requested read begins at.
|
||||
|
||||
|
||||
:length: The number of bytes being requested.
|
||||
|
||||
.. bro:see:: smb1_message smb1_read_andx_response
|
||||
|
||||
.. bro:id:: smb1_read_andx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, data_len: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *read andx*. This is the server response to the *read andx* request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.42
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:data_len: The length of data from the requested file.
|
||||
|
||||
.. bro:see:: smb1_message smb1_read_andx_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_session_setup_andx.bif.bro
|
||||
============================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================================= ===========================================================================================
|
||||
:bro:id:`smb1_session_setup_andx_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *setup andx*.
|
||||
:bro:id:`smb1_session_setup_andx_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *setup andx*.
|
||||
============================================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_session_setup_andx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, request: :bro:type:`SMB1::SessionSetupAndXRequest`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *setup andx*. This is sent by the client to configure an SMB session.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.53
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:request: The parsed request data of the SMB message. See init-bare for more details.
|
||||
|
||||
.. bro:see:: smb1_message smb1_session_setup_andx_response
|
||||
|
||||
.. bro:id:: smb1_session_setup_andx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, response: :bro:type:`SMB1::SessionSetupAndXResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *setup andx*. This is the server response to the *setup andx* request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.53
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:response: The parsed response data of the SMB message. See init-bare for more details.
|
||||
|
||||
.. bro:see:: smb1_message smb1_session_setup_andx_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_transaction.bif.bro
|
||||
=====================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
====================================================== ===========================================================================================
|
||||
:bro:id:`smb1_transaction_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction*.
|
||||
:bro:id:`smb1_transaction_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction*.
|
||||
====================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_transaction_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, name: :bro:type:`string`, sub_cmd: :bro:type:`count`, parameters: :bro:type:`string`, data: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction*. This command serves as the transport for the
|
||||
Transaction Subprotocol Commands. These commands operate on mailslots and named pipes,
|
||||
which are interprocess communication endpoints within the CIFS file system.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.33.1
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:name: A name string that MAY identify the resource (a specific Mailslot or Named Pipe)
|
||||
against which the operation is performed.
|
||||
|
||||
|
||||
:sub_cmd: The sub command, some may be parsed and have their own events.
|
||||
|
||||
|
||||
:parameters: content of the SMB_Data.Trans_Parameters field
|
||||
|
||||
|
||||
:data: content of the SMB_Data.Trans_Data field
|
||||
|
||||
.. bro:see:: smb1_message smb1_transaction2_request
|
||||
|
||||
.. bro:id:: smb1_transaction_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, parameters: :bro:type:`string`, data: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction*. This command serves as the transport for the
|
||||
Transaction Subprotocol Commands. These commands operate on mailslots and named pipes,
|
||||
which are interprocess communication endpoints within the CIFS file system.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.33.2
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:parameters: content of the SMB_Data.Trans_Parameters field
|
||||
|
||||
|
||||
:data: content of the SMB_Data.Trans_Data field
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,122 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_transaction2.bif.bro
|
||||
======================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================================= ===========================================================================================
|
||||
:bro:id:`smb1_trans2_find_first2_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 *transaction2* requests of subtype *find first2*.
|
||||
:bro:id:`smb1_trans2_get_dfs_referral_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 *transaction2* requests of subtype *get DFS referral*.
|
||||
:bro:id:`smb1_trans2_query_path_info_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 *transaction2* requests of subtype *query path info*.
|
||||
:bro:id:`smb1_transaction2_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction2*.
|
||||
================================================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_trans2_find_first2_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, args: :bro:type:`SMB1::Find_First2_Request_Args`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 *transaction2* requests of subtype *find first2*. This transaction is used to begin
|
||||
a search for file(s) within a directory or for a directory
|
||||
|
||||
For more information, see MS-CIFS:2.2.6.2
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:args: A record data structure with arguments given to the command.
|
||||
|
||||
.. bro:see:: smb1_message smb1_transaction2_request smb1_trans2_query_path_info_request
|
||||
smb1_trans2_get_dfs_referral_request
|
||||
|
||||
.. bro:id:: smb1_trans2_get_dfs_referral_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_name: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 *transaction2* requests of subtype *get DFS referral*. This transaction is used
|
||||
to request a referral for a disk object in DFS.
|
||||
|
||||
For more information, see MS-CIFS:2.2.6.16
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:file_name: File name the request is in reference to.
|
||||
|
||||
.. bro:see:: smb1_message smb1_transaction2_request smb1_trans2_find_first2_request
|
||||
smb1_trans2_query_path_info_request
|
||||
|
||||
.. bro:id:: smb1_trans2_query_path_info_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_name: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 *transaction2* requests of subtype *query path info*. This transaction is used to
|
||||
get information about a specific file or directory.
|
||||
|
||||
For more information, see MS-CIFS:2.2.6.6
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:file_name: File name the request is in reference to.
|
||||
|
||||
.. bro:see:: smb1_message smb1_transaction2_request smb1_trans2_find_first2_request
|
||||
smb1_trans2_get_dfs_referral_request
|
||||
|
||||
.. bro:id:: smb1_transaction2_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, args: :bro:type:`SMB1::Trans2_Args`, sub_cmd: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction2*. This command serves as the transport for the
|
||||
Transaction2 Subprotocol Commands. These commands operate on mailslots and named pipes,
|
||||
which are interprocess communication endpoints within the CIFS file system. Compared to the
|
||||
Transaction Subprotocol Commands, these commands allow clients to set and retrieve Extended
|
||||
Attribute key/value pairs, make use of long file names (longer than the original 8.3 format
|
||||
names), and perform directory searches, among other tasks.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.46
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:sub_cmd: The sub command, some are parsed and have their own events.
|
||||
|
||||
.. bro:see:: smb1_message smb1_trans2_find_first2_request smb1_trans2_query_path_info_request
|
||||
smb1_trans2_get_dfs_referral_request smb1_transaction_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_transaction2_secondary.bif.bro
|
||||
================================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================================ ===========================================================================================
|
||||
:bro:id:`smb1_transaction2_secondary_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction2 secondary*.
|
||||
================================================================ ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_transaction2_secondary_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, args: :bro:type:`SMB1::Trans2_Sec_Args`, parameters: :bro:type:`string`, data: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction2 secondary*.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.47.1
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)`
|
||||
version 1 message.
|
||||
|
||||
|
||||
:args: arguments of the message (SMB_Parameters.Words)
|
||||
|
||||
|
||||
:parameters: content of the SMB_Data.Trans_Parameters field
|
||||
|
||||
|
||||
:data: content of the SMB_Data.Trans_Data field
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_transaction_secondary.bif.bro
|
||||
===============================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=============================================================== ===========================================================================================
|
||||
:bro:id:`smb1_transaction_secondary_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction_secondary*.
|
||||
=============================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_transaction_secondary_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, args: :bro:type:`SMB1::Trans_Sec_Args`, parameters: :bro:type:`string`, data: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *transaction_secondary*. This command
|
||||
serves as an additional request data container for the
|
||||
Transaction Subprotocol Commands (carried by *transaction* requests).
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.34
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:parameters: the SMB_Data.Trans_Parameters field content
|
||||
|
||||
|
||||
:data: the SMB_Data.Trans_Data field content
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_tree_connect_andx.bif.bro
|
||||
===========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================================ ===========================================================================================
|
||||
:bro:id:`smb1_tree_connect_andx_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *tree connect andx*.
|
||||
:bro:id:`smb1_tree_connect_andx_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *tree connect andx*.
|
||||
============================================================ ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_tree_connect_andx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, path: :bro:type:`string`, service: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *tree connect andx*. This is sent by the client to establish a
|
||||
connection to a server share.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.55
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:path: The ``path`` attribute specified in the message.
|
||||
|
||||
|
||||
:service: The ``service`` attribute specified in the message.
|
||||
|
||||
.. bro:see:: smb1_message smb1_tree_connect_andx_response
|
||||
|
||||
.. bro:id:: smb1_tree_connect_andx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, service: :bro:type:`string`, native_file_system: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *tree connect andx*. This is the server reply to the *tree connect andx*
|
||||
request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.55
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:service: The ``service`` attribute specified in the message.
|
||||
|
||||
|
||||
:native_file_system: The file system of the remote server as indicate by the server.
|
||||
|
||||
.. bro:see:: smb1_message smb1_tree_connect_andx_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_tree_disconnect.bif.bro
|
||||
=========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================= ===========================================================================================
|
||||
:bro:id:`smb1_tree_disconnect`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *tree disconnect*.
|
||||
================================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_tree_disconnect
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *tree disconnect*. This is sent by the client to logically disconnect
|
||||
client access to a server resource.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.51
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:is_orig: True if the message was from the originator.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,72 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_com_write_andx.bif.bro
|
||||
====================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
===================================================== ===========================================================================================
|
||||
:bro:id:`smb1_write_andx_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *write andx*.
|
||||
:bro:id:`smb1_write_andx_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *write andx*.
|
||||
===================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_write_andx_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, file_id: :bro:type:`count`, offset: :bro:type:`count`, data_len: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 requests of type *write andx*. This is sent by the client to write bytes to a
|
||||
regular file, a named pipe, or a directly accessible I/O device such as a serial port (COM)
|
||||
or printer port (LPT).
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.43
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:offset: The byte offset into the referenced file data is being written.
|
||||
|
||||
|
||||
:data: The data being written.
|
||||
|
||||
.. bro:see:: smb1_message smb1_write_andx_response
|
||||
|
||||
.. bro:id:: smb1_write_andx_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, written_bytes: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 1 responses of type *write andx*. This is the server response to the *write andx*
|
||||
request.
|
||||
|
||||
For more information, see MS-CIFS:2.2.4.43
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:written_bytes: The number of bytes the server reported having actually written.
|
||||
|
||||
.. bro:see:: smb1_message smb1_write_andx_request
|
||||
|
||||
|
||||
86
doc/scripts/base/bif/plugins/Bro_SMB.smb1_events.bif.bro.rst
Normal file
86
doc/scripts/base/bif/plugins/Bro_SMB.smb1_events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb1_events.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================ =========================================================================================================
|
||||
:bro:id:`smb1_empty_response`: :bro:type:`event` Generated when there is an :abbr:`SMB (Server Message Block)` version 1 response with no message body.
|
||||
:bro:id:`smb1_error`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)` version 1 messages
|
||||
that indicate an error.
|
||||
:bro:id:`smb1_message`: :bro:type:`event` Generated for all :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` version 1
|
||||
messages.
|
||||
================================================ =========================================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb1_empty_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`)
|
||||
|
||||
Generated when there is an :abbr:`SMB (Server Message Block)` version 1 response with no message body.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` message.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
.. bro:id:: smb1_error
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)` version 1 messages
|
||||
that indicate an error. This event is triggered by an :abbr:`SMB (Server Message Block)` header
|
||||
including a status that signals an error.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` message.
|
||||
|
||||
|
||||
:is_orig: True if the message was sent by the originator of the underlying
|
||||
transport-level connection.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
.. bro:id:: smb1_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB1::Header`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for all :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` version 1
|
||||
messages.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the
|
||||
:abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Bro's
|
||||
:abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses
|
||||
both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on
|
||||
ports 138/139 and :abbr:`SMB (Server Message Block)`-over-TCP on port 445.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 1 message.
|
||||
|
||||
|
||||
:is_orig: True if the message was sent by the originator of the underlying
|
||||
transport-level connection.
|
||||
|
||||
.. bro:see:: smb2_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_close.bif.bro
|
||||
===============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================ ===========================================================================================
|
||||
:bro:id:`smb2_close_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *close*.
|
||||
:bro:id:`smb2_close_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *close*.
|
||||
================================================ ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_close_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, file_id: :bro:type:`SMB2::GUID`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *close*. This is used by the client to close an instance of a
|
||||
file that was opened previously with a successful SMB2 CREATE Request.
|
||||
|
||||
For more information, see MS-SMB2:2.2.15
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:file_name: The SMB2 GUID of the file being closed.
|
||||
|
||||
.. bro:see:: smb2_message smb2_close_response
|
||||
|
||||
.. bro:id:: smb2_close_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, response: :bro:type:`SMB2::CloseResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *close*. This is sent by the server to indicate that an SMB2 CLOSE
|
||||
request was processed successfully.
|
||||
|
||||
For more information, see MS-SMB2:2.2.16
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:response: A record of attributes returned from the server from the close.
|
||||
|
||||
.. bro:see:: smb2_message smb2_close_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_create.bif.bro
|
||||
================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================= ===========================================================================================
|
||||
:bro:id:`smb2_create_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *create*.
|
||||
:bro:id:`smb2_create_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *create*.
|
||||
================================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_create_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, request: :bro:type:`SMB2::CreateRequest`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *create*. This is sent by the client to request either creation
|
||||
of or access to a file.
|
||||
|
||||
For more information, see MS-SMB2:2.2.13
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:request: A record with more information related to the request.
|
||||
|
||||
.. bro:see:: smb2_message smb2_create_response
|
||||
|
||||
.. bro:id:: smb2_create_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, response: :bro:type:`SMB2::CreateResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *create*. This is sent by the server to notify the client of
|
||||
the status of its SMB2 CREATE request.
|
||||
|
||||
For more information, see MS-SMB2:2.2.14
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:response: A record with more information related to the response.
|
||||
|
||||
.. bro:see:: smb2_message smb2_create_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_negotiate.bif.bro
|
||||
===================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
==================================================== ===========================================================================================
|
||||
:bro:id:`smb2_negotiate_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *negotiate*.
|
||||
:bro:id:`smb2_negotiate_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *negotiate*.
|
||||
==================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_negotiate_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, dialects: :bro:type:`index_vec`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *negotiate*. This is used by the client to notify the server what
|
||||
dialects of the SMB2 Protocol the client understands.
|
||||
|
||||
For more information, see MS-SMB2:2.2.3
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:dialects: A vector of the client's supported dialects.
|
||||
|
||||
.. bro:see:: smb2_message smb2_negotiate_response
|
||||
|
||||
.. bro:id:: smb2_negotiate_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, response: :bro:type:`SMB2::NegotiateResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *negotiate*. This is sent by the server to notify the client of
|
||||
the preferred common dialect.
|
||||
|
||||
For more information, see MS-SMB2:2.2.4
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:response: The negotiate response data structure.
|
||||
|
||||
.. bro:see:: smb2_message smb2_negotiate_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_read.bif.bro
|
||||
==============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================== ===========================================================================================
|
||||
:bro:id:`smb2_read_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *read*.
|
||||
============================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_read_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, file_id: :bro:type:`SMB2::GUID`, offset: :bro:type:`count`, length: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *read*. This is sent by the client to request a read operation on
|
||||
the specified file.
|
||||
|
||||
For more information, see MS-SMB2:2.2.19
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:file_id: The GUID being used for the file.
|
||||
|
||||
|
||||
:offset: How far into the file this read should be taking place.
|
||||
|
||||
|
||||
:length: The number of bytes of the file being read.
|
||||
|
||||
.. bro:see:: smb2_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_session_setup.bif.bro
|
||||
=======================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================== ===========================================================================================
|
||||
:bro:id:`smb2_session_setup_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *session_setup*.
|
||||
:bro:id:`smb2_session_setup_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *session_setup*.
|
||||
======================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_session_setup_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, request: :bro:type:`SMB2::SessionSetupRequest`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *session_setup*. This is sent by the client to request a new
|
||||
authenticated session within a new or existing SMB 2 Protocol transport connection to the
|
||||
server.
|
||||
|
||||
For more information, see MS-SMB2:2.2.5
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:request: A record containing more information related to the request.
|
||||
|
||||
.. bro:see:: smb2_message smb2_session_setup_response
|
||||
|
||||
.. bro:id:: smb2_session_setup_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, response: :bro:type:`SMB2::SessionSetupResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *session_setup*. This is sent by the server in response to a
|
||||
*session_setup* request.
|
||||
|
||||
For more information, see MS-SMB2:2.2.6
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:response: A record containing more information related to the response.
|
||||
|
||||
.. bro:see:: smb2_message smb2_session_setup_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_set_info.bif.bro
|
||||
==================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================= ===========================================================================================
|
||||
:bro:id:`smb2_file_delete`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *set_info* of the *delete* subtype.
|
||||
:bro:id:`smb2_file_rename`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *set_info* of the *rename* subtype.
|
||||
:bro:id:`smb2_file_sattr`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *set_info* of the *file* subtype
|
||||
============================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_file_delete
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, file_id: :bro:type:`SMB2::GUID`, delete_pending: :bro:type:`bool`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *set_info* of the *delete* subtype.
|
||||
|
||||
For more information, see MS-SMB2:2.2.39
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:file_id: The SMB2 GUID for the file.
|
||||
|
||||
|
||||
:delete_pending: A boolean value to indicate that a file should be deleted
|
||||
when it's closed if set to T.
|
||||
|
||||
.. bro:see:: smb2_message smb2_file_rename smb2_file_sattr
|
||||
|
||||
.. bro:id:: smb2_file_rename
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, file_id: :bro:type:`SMB2::GUID`, dst_filename: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *set_info* of the *rename* subtype.
|
||||
|
||||
For more information, see MS-SMB2:2.2.39
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:file_id: A GUID to identify the file.
|
||||
|
||||
|
||||
:dst_filename: The filename to rename the file into.
|
||||
|
||||
.. bro:see:: smb2_message smb2_file_delete smb2_file_sattr
|
||||
|
||||
.. bro:id:: smb2_file_sattr
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, file_id: :bro:type:`SMB2::GUID`, times: :bro:type:`SMB::MACTimes`, attrs: :bro:type:`SMB2::FileAttrs`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *set_info* of the *file* subtype
|
||||
|
||||
For more infomation, see MS-SMB2:2.2.39
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:file_id: The SMB2 GUID for the file.
|
||||
|
||||
|
||||
:times: Timestamps associated with the file in question.
|
||||
|
||||
|
||||
:attrs: File attributes.
|
||||
|
||||
.. bro:see:: smb2_message smb2_file_rename smb2_file_delete
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_tree_connect.bif.bro
|
||||
======================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================= ===========================================================================================
|
||||
:bro:id:`smb2_tree_connect_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *tree_connect*.
|
||||
:bro:id:`smb2_tree_connect_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *tree_connect*.
|
||||
======================================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_tree_connect_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, path: :bro:type:`string`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *tree_connect*. This is sent by a client to request access to a
|
||||
particular share on the server.
|
||||
|
||||
For more information, see MS-SMB2:2.2.9
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:path: Path of the requested tree.
|
||||
|
||||
.. bro:see:: smb2_message smb2_tree_connect_response
|
||||
|
||||
.. bro:id:: smb2_tree_connect_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, response: :bro:type:`SMB2::TreeConnectResponse`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 responses of type *tree_connect*. This is sent by the server when a *tree_connect*
|
||||
request is successfully processed by the server.
|
||||
|
||||
For more information, see MS-SMB2:2.2.10
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:response: A record with more information related to the response.
|
||||
|
||||
.. bro:see:: smb2_message smb2_tree_connect_request
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_tree_disconnect.bif.bro
|
||||
=========================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================== ===========================================================================================
|
||||
:bro:id:`smb2_tree_disconnect_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *tree disconnect*.
|
||||
:bro:id:`smb2_tree_disconnect_response`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *tree disconnect*.
|
||||
========================================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_tree_disconnect_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *tree disconnect*. This is sent by the client to logically disconnect
|
||||
client access to a server resource.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
.. bro:see:: smb2_message
|
||||
|
||||
.. bro:id:: smb2_tree_disconnect_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *tree disconnect*. This is sent by the server to logically disconnect
|
||||
client access to a server resource.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
.. bro:see:: smb2_message
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_com_write.bif.bro
|
||||
===============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
=============================================== ===========================================================================================
|
||||
:bro:id:`smb2_write_request`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *write*.
|
||||
=============================================== ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_write_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, file_id: :bro:type:`SMB2::GUID`, offset: :bro:type:`count`, length: :bro:type:`count`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 requests of type *write*. This is sent by the client to write data to the file or
|
||||
named pipe on the server.
|
||||
|
||||
For more information, see MS-SMB2:2.2.21
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:file_id: The GUID being used for the file.
|
||||
|
||||
|
||||
:offset: How far into the file this write should be taking place.
|
||||
|
||||
|
||||
:length: The number of bytes of the file being written.
|
||||
|
||||
.. bro:see:: smb2_message
|
||||
|
||||
|
||||
48
doc/scripts/base/bif/plugins/Bro_SMB.smb2_events.bif.bro.rst
Normal file
48
doc/scripts/base/bif/plugins/Bro_SMB.smb2_events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.smb2_events.bif.bro
|
||||
============================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================= ===========================================================================================
|
||||
:bro:id:`smb2_message`: :bro:type:`event` Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 messages.
|
||||
========================================= ===========================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smb2_message
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, hdr: :bro:type:`SMB2::Header`, is_orig: :bro:type:`bool`)
|
||||
|
||||
Generated for :abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)`
|
||||
version 2 messages.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Server_Message_Block>`__ for more information about the
|
||||
:abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` protocol. Bro's
|
||||
:abbr:`SMB (Server Message Block)`/:abbr:`CIFS (Common Internet File System)` analyzer parses
|
||||
both :abbr:`SMB (Server Message Block)`-over-:abbr:`NetBIOS (Network Basic Input/Output System)` on
|
||||
ports 138/139 and :abbr:`SMB (Server Message Block)`-over-TCP on port 445.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:hdr: The parsed header of the :abbr:`SMB (Server Message Block)` version 2 message.
|
||||
|
||||
|
||||
:is_orig: True if the message came from the originator side.
|
||||
|
||||
.. bro:see:: smb1_message
|
||||
|
||||
|
||||
15
doc/scripts/base/bif/plugins/Bro_SMB.types.bif.bro.rst
Normal file
15
doc/scripts/base/bif/plugins/Bro_SMB.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMB.types.bif.bro
|
||||
======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
169
doc/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro.rst
Normal file
169
doc/scripts/base/bif/plugins/Bro_SMTP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,169 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMTP.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
============================================ =================================================================================
|
||||
:bro:id:`smtp_data`: :bro:type:`event` Generated for DATA transmitted on SMTP sessions.
|
||||
:bro:id:`smtp_reply`: :bro:type:`event` Generated for server-side SMTP commands.
|
||||
:bro:id:`smtp_request`: :bro:type:`event` Generated for client-side SMTP commands.
|
||||
:bro:id:`smtp_starttls`: :bro:type:`event` Generated if a connection switched to using TLS using STARTTLS or X-ANONYMOUSTLS.
|
||||
:bro:id:`smtp_unexpected`: :bro:type:`event` Generated for unexpected activity on SMTP sessions.
|
||||
============================================ =================================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: smtp_data
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, data: :bro:type:`string`)
|
||||
|
||||
Generated for DATA transmitted on SMTP sessions. This event is raised for
|
||||
subsequent chunks of raw data following the ``DATA`` SMTP command until the
|
||||
corresponding end marker ``.`` is seen. A handler may want to reassemble
|
||||
the pieces as they come in if stream-analysis is required.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
|
||||
for more information about the SMTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the sender of the data is the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:data: The raw data. Note that the size of each chunk is undefined and
|
||||
depends on specifics of the underlying TCP connection.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_entity_data mime_event mime_one_header mime_segment_data
|
||||
smtp_reply smtp_request skip_smtp_data
|
||||
|
||||
.. note:: This event receives the unprocessed raw data. There is a separate
|
||||
set of ``mime_*`` events that strip out the outer MIME-layer of emails and
|
||||
provide structured access to their content.
|
||||
|
||||
.. bro:id:: smtp_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, code: :bro:type:`count`, cmd: :bro:type:`string`, msg: :bro:type:`string`, cont_resp: :bro:type:`bool`)
|
||||
|
||||
Generated for server-side SMTP commands.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
|
||||
for more information about the SMTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the sender of the command is the originator of the TCP
|
||||
connection. Note that this is not redundant: the SMTP ``TURN`` command
|
||||
allows client and server to flip roles on established SMTP sessions,
|
||||
and hence a "reply" might still come from the TCP-level originator. In
|
||||
practice, however, that will rarely happen as TURN is considered
|
||||
insecure and rarely used.
|
||||
|
||||
|
||||
:code: The reply's numerical code.
|
||||
|
||||
|
||||
:cmd: TODO.
|
||||
|
||||
|
||||
:msg: The reply's textual description.
|
||||
|
||||
|
||||
:cont_resp: True if the reply line is tagged as being continued to the next
|
||||
line. If so, further events will be raised and a handler may want to
|
||||
reassemble the pieces before processing the response any further.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_entity_data mime_event mime_one_header mime_segment_data
|
||||
smtp_data smtp_request
|
||||
|
||||
.. note:: Bro doesn't support the newer ETRN extension yet.
|
||||
|
||||
.. bro:id:: smtp_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, command: :bro:type:`string`, arg: :bro:type:`string`)
|
||||
|
||||
Generated for client-side SMTP commands.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
|
||||
for more information about the SMTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the sender of the command is the originator of the TCP
|
||||
connection. Note that this is not redundant: the SMTP ``TURN`` command
|
||||
allows client and server to flip roles on established SMTP sessions,
|
||||
and hence a "request" might still come from the TCP-level responder.
|
||||
In practice, however, that will rarely happen as TURN is considered
|
||||
insecure and rarely used.
|
||||
|
||||
|
||||
:command: The request's command, without any arguments.
|
||||
|
||||
|
||||
:arg: The request command's arguments.
|
||||
|
||||
.. bro:see:: mime_all_data mime_all_headers mime_begin_entity mime_content_hash
|
||||
mime_end_entity mime_entity_data mime_event mime_one_header mime_segment_data
|
||||
smtp_data smtp_reply
|
||||
|
||||
.. note:: Bro does not support the newer ETRN extension yet.
|
||||
|
||||
.. bro:id:: smtp_starttls
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`)
|
||||
|
||||
Generated if a connection switched to using TLS using STARTTLS or X-ANONYMOUSTLS.
|
||||
After this event no more SMTP events will be raised for the connection. See the SSL
|
||||
analyzer for related SSL events, which will now be generated.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
.. bro:id:: smtp_unexpected
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, msg: :bro:type:`string`, detail: :bro:type:`string`)
|
||||
|
||||
Generated for unexpected activity on SMTP sessions. The SMTP analyzer tracks
|
||||
the state of SMTP sessions and reports commands and other activity with this
|
||||
event that it sees even though it would not expect so at the current point
|
||||
of the communication.
|
||||
|
||||
See `Wikipedia <http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol>`__
|
||||
for more information about the SMTP protocol.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:is_orig: True if the sender of the unexpected activity is the originator of
|
||||
the TCP connection.
|
||||
|
||||
|
||||
:msg: A descriptive message of what was unexpected.
|
||||
|
||||
|
||||
:detail: The actual SMTP line triggering the event.
|
||||
|
||||
.. bro:see:: smtp_data smtp_request smtp_reply
|
||||
|
||||
|
||||
34
doc/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro.rst
Normal file
34
doc/scripts/base/bif/plugins/Bro_SMTP.functions.bif.bro.rst
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SMTP.functions.bif.bro
|
||||
===========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
============================================== =====================================================
|
||||
:bro:id:`skip_smtp_data`: :bro:type:`function` Skips SMTP data until the next email in a connection.
|
||||
============================================== =====================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Functions
|
||||
#########
|
||||
.. bro:id:: skip_smtp_data
|
||||
|
||||
:Type: :bro:type:`function` (c: :bro:type:`connection`) : :bro:type:`any`
|
||||
|
||||
Skips SMTP data until the next email in a connection.
|
||||
|
||||
|
||||
:c: The SMTP connection.
|
||||
|
||||
.. bro:see:: skip_http_entity_data
|
||||
|
||||
|
||||
281
doc/scripts/base/bif/plugins/Bro_SNMP.events.bif.bro.rst
Normal file
281
doc/scripts/base/bif/plugins/Bro_SNMP.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,281 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SNMP.events.bif.bro
|
||||
========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
======================================================== ==========================================================================
|
||||
:bro:id:`snmp_encrypted_pdu`: :bro:type:`event` An SNMPv3 encrypted PDU message.
|
||||
:bro:id:`snmp_get_bulk_request`: :bro:type:`event` An SNMP ``GetBulkRequest-PDU`` message from :rfc:`3416`.
|
||||
:bro:id:`snmp_get_next_request`: :bro:type:`event` An SNMP ``GetNextRequest-PDU`` message from either :rfc:`1157` or
|
||||
:rfc:`3416`.
|
||||
:bro:id:`snmp_get_request`: :bro:type:`event` An SNMP ``GetRequest-PDU`` message from either :rfc:`1157` or :rfc:`3416`.
|
||||
:bro:id:`snmp_inform_request`: :bro:type:`event` An SNMP ``InformRequest-PDU`` message from :rfc:`3416`.
|
||||
:bro:id:`snmp_report`: :bro:type:`event` An SNMP ``Report-PDU`` message from :rfc:`3416`.
|
||||
:bro:id:`snmp_response`: :bro:type:`event` An SNMP ``GetResponse-PDU`` message from :rfc:`1157` or a
|
||||
``Response-PDU`` from :rfc:`3416`.
|
||||
:bro:id:`snmp_set_request`: :bro:type:`event` An SNMP ``SetRequest-PDU`` message from either :rfc:`1157` or :rfc:`3416`.
|
||||
:bro:id:`snmp_trap`: :bro:type:`event` An SNMP ``Trap-PDU`` message from :rfc:`1157`.
|
||||
:bro:id:`snmp_trapV2`: :bro:type:`event` An SNMP ``SNMPv2-Trap-PDU`` message from :rfc:`1157`.
|
||||
:bro:id:`snmp_unknown_header_version`: :bro:type:`event` A datagram with an unknown SNMP version.
|
||||
:bro:id:`snmp_unknown_pdu`: :bro:type:`event` An SNMP PDU message of unknown type.
|
||||
:bro:id:`snmp_unknown_scoped_pdu`: :bro:type:`event` An SNMPv3 ``ScopedPDUData`` of unknown type (neither plaintext or
|
||||
an encrypted PDU was in the datagram).
|
||||
======================================================== ==========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: snmp_encrypted_pdu
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`)
|
||||
|
||||
An SNMPv3 encrypted PDU message.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
.. bro:id:: snmp_get_bulk_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::BulkPDU`)
|
||||
|
||||
An SNMP ``GetBulkRequest-PDU`` message from :rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_get_next_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``GetNextRequest-PDU`` message from either :rfc:`1157` or
|
||||
:rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_get_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``GetRequest-PDU`` message from either :rfc:`1157` or :rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_inform_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``InformRequest-PDU`` message from :rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_report
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``Report-PDU`` message from :rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_response
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``GetResponse-PDU`` message from :rfc:`1157` or a
|
||||
``Response-PDU`` from :rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_set_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``SetRequest-PDU`` message from either :rfc:`1157` or :rfc:`3416`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_trap
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::TrapPDU`)
|
||||
|
||||
An SNMP ``Trap-PDU`` message from :rfc:`1157`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_trapV2
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, pdu: :bro:type:`SNMP::PDU`)
|
||||
|
||||
An SNMP ``SNMPv2-Trap-PDU`` message from :rfc:`1157`.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:pdu: An SNMP PDU data structure.
|
||||
|
||||
.. bro:id:: snmp_unknown_header_version
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, version: :bro:type:`count`)
|
||||
|
||||
A datagram with an unknown SNMP version.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:version: The value of the unknown SNMP version.
|
||||
|
||||
.. bro:id:: snmp_unknown_pdu
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, tag: :bro:type:`count`)
|
||||
|
||||
An SNMP PDU message of unknown type.
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:tag: The tag of the unknown SNMP PDU.
|
||||
|
||||
.. bro:id:: snmp_unknown_scoped_pdu
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, header: :bro:type:`SNMP::Header`, tag: :bro:type:`count`)
|
||||
|
||||
An SNMPv3 ``ScopedPDUData`` of unknown type (neither plaintext or
|
||||
an encrypted PDU was in the datagram).
|
||||
|
||||
|
||||
:c: The connection over which the SNMP datagram is sent.
|
||||
|
||||
|
||||
:is_orig: The endpoint which sent the SNMP datagram.
|
||||
|
||||
|
||||
:header: SNMP version-dependent data that precedes PDU data in the top-level
|
||||
SNMP message structure.
|
||||
|
||||
|
||||
:tag: The tag of the unknown SNMP PDU scope.
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_SNMP.types.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_SNMP.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SNMP.types.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: SNMP
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, SNMP
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
99
doc/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro.rst
Normal file
99
doc/scripts/base/bif/plugins/Bro_SOCKS.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,99 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SOCKS.events.bif.bro
|
||||
=========================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
========================================================= ===========================================================================
|
||||
:bro:id:`socks_login_userpass_reply`: :bro:type:`event` Generated when a SOCKS server replies to a username/password login attempt.
|
||||
:bro:id:`socks_login_userpass_request`: :bro:type:`event` Generated when a SOCKS client performs username and password based login.
|
||||
:bro:id:`socks_reply`: :bro:type:`event` Generated when a SOCKS reply is analyzed.
|
||||
:bro:id:`socks_request`: :bro:type:`event` Generated when a SOCKS request is analyzed.
|
||||
========================================================= ===========================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: socks_login_userpass_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, code: :bro:type:`count`)
|
||||
|
||||
Generated when a SOCKS server replies to a username/password login attempt.
|
||||
|
||||
|
||||
:c: The parent connection of the proxy.
|
||||
|
||||
|
||||
:code: The response code for the attempted login.
|
||||
|
||||
.. bro:id:: socks_login_userpass_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, user: :bro:type:`string`, password: :bro:type:`string`)
|
||||
|
||||
Generated when a SOCKS client performs username and password based login.
|
||||
|
||||
|
||||
:c: The parent connection of the proxy.
|
||||
|
||||
|
||||
:user: The given username.
|
||||
|
||||
|
||||
:password: The given password.
|
||||
|
||||
.. bro:id:: socks_reply
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, version: :bro:type:`count`, reply: :bro:type:`count`, sa: :bro:type:`SOCKS::Address`, p: :bro:type:`port`)
|
||||
|
||||
Generated when a SOCKS reply is analyzed.
|
||||
|
||||
|
||||
:c: The parent connection of the proxy.
|
||||
|
||||
|
||||
:version: The version of SOCKS this message used.
|
||||
|
||||
|
||||
:reply: The status reply from the server.
|
||||
|
||||
|
||||
:sa: The address that the server sent the traffic to.
|
||||
|
||||
|
||||
:p: The destination port for the proxied traffic.
|
||||
|
||||
.. bro:id:: socks_request
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, version: :bro:type:`count`, request_type: :bro:type:`count`, sa: :bro:type:`SOCKS::Address`, p: :bro:type:`port`, user: :bro:type:`string`)
|
||||
|
||||
Generated when a SOCKS request is analyzed.
|
||||
|
||||
|
||||
:c: The parent connection of the proxy.
|
||||
|
||||
|
||||
:version: The version of SOCKS this message used.
|
||||
|
||||
|
||||
:request_type: The type of the request.
|
||||
|
||||
|
||||
:sa: Address that the tunneled traffic should be sent to.
|
||||
|
||||
|
||||
:p: The destination port for the proxied traffic.
|
||||
|
||||
|
||||
:user: Username given for the SOCKS connection. This is not yet implemented
|
||||
for SOCKSv5.
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SQLiteReader.sqlite.bif.bro
|
||||
================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: InputSQLite
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, InputSQLite
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
|
||||
================================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: LogSQLite
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, LogSQLite
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
330
doc/scripts/base/bif/plugins/Bro_SSH.events.bif.bro.rst
Normal file
330
doc/scripts/base/bif/plugins/Bro_SSH.events.bif.bro.rst
Normal file
|
|
@ -0,0 +1,330 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SSH.events.bif.bro
|
||||
=======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
|
||||
|
||||
:Namespace: GLOBAL
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
Events
|
||||
######
|
||||
================================================== ==================================================================
|
||||
:bro:id:`ssh1_server_host_key`: :bro:type:`event` During the :abbr:`SSH (Secure Shell)` key exchange, the server
|
||||
supplies its public host key.
|
||||
:bro:id:`ssh2_dh_server_params`: :bro:type:`event` Generated if the connection uses a Diffie-Hellman Group Exchange
|
||||
key exchange method.
|
||||
:bro:id:`ssh2_ecc_key`: :bro:type:`event` The :abbr:`ECDH (Elliptic Curve Diffie-Hellman)` and
|
||||
:abbr:`ECMQV (Elliptic Curve Menezes-Qu-Vanstone)` key exchange
|
||||
algorithms use two ephemeral key pairs to generate a shared
|
||||
secret.
|
||||
:bro:id:`ssh2_gss_error`: :bro:type:`event` In the event of a GSS-API error on the server, the server MAY send
|
||||
send an error message with some additional details.
|
||||
:bro:id:`ssh2_server_host_key`: :bro:type:`event` During the :abbr:`SSH (Secure Shell)` key exchange, the server
|
||||
supplies its public host key.
|
||||
:bro:id:`ssh_auth_attempted`: :bro:type:`event` This event is generated when an :abbr:`SSH (Secure Shell)`
|
||||
connection was determined to have had an authentication attempt.
|
||||
:bro:id:`ssh_auth_successful`: :bro:type:`event` This event is generated when an :abbr:`SSH (Secure Shell)`
|
||||
connection was determined to have had a successful
|
||||
authentication.
|
||||
:bro:id:`ssh_capabilities`: :bro:type:`event` During the initial :abbr:`SSH (Secure Shell)` key exchange, each
|
||||
endpoint lists the algorithms that it supports, in order of
|
||||
preference.
|
||||
:bro:id:`ssh_client_version`: :bro:type:`event` An :abbr:`SSH (Secure Shell)` Protocol Version Exchange message
|
||||
from the client.
|
||||
:bro:id:`ssh_encrypted_packet`: :bro:type:`event` This event is generated when an :abbr:`SSH (Secure Shell)`
|
||||
encrypted packet is seen.
|
||||
:bro:id:`ssh_server_version`: :bro:type:`event` An :abbr:`SSH (Secure Shell)` Protocol Version Exchange message
|
||||
from the server.
|
||||
================================================== ==================================================================
|
||||
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
Events
|
||||
######
|
||||
.. bro:id:: ssh1_server_host_key
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, p: :bro:type:`string`, e: :bro:type:`string`)
|
||||
|
||||
During the :abbr:`SSH (Secure Shell)` key exchange, the server
|
||||
supplies its public host key. This event is generated when the
|
||||
appropriate key exchange message is seen for SSH1.
|
||||
|
||||
|
||||
:c: The connection over which the :abbr:`SSH (Secure Shell)`
|
||||
connection took place.
|
||||
|
||||
|
||||
:p: The prime for the server's public host key.
|
||||
|
||||
|
||||
:e: The exponent for the serer's public host key.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh_capabilities ssh2_server_host_key
|
||||
ssh_server_host_key ssh_encrypted_packet ssh2_dh_server_params
|
||||
ssh2_gss_error ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh2_dh_server_params
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, p: :bro:type:`string`, q: :bro:type:`string`)
|
||||
|
||||
Generated if the connection uses a Diffie-Hellman Group Exchange
|
||||
key exchange method. This event contains the server DH parameters,
|
||||
which are sent in the SSH_MSG_KEY_DH_GEX_GROUP message as defined in
|
||||
:rfc:`4419#section-3`.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:p: The DH prime modulus.
|
||||
|
||||
|
||||
:q: The DH generator.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh_capabilities ssh2_server_host_key
|
||||
ssh1_server_host_key ssh_server_host_key ssh_encrypted_packet
|
||||
ssh2_gss_error ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh2_ecc_key
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, is_orig: :bro:type:`bool`, q: :bro:type:`string`)
|
||||
|
||||
The :abbr:`ECDH (Elliptic Curve Diffie-Hellman)` and
|
||||
:abbr:`ECMQV (Elliptic Curve Menezes-Qu-Vanstone)` key exchange
|
||||
algorithms use two ephemeral key pairs to generate a shared
|
||||
secret. This event is generated when either the client's or
|
||||
server's ephemeral public key is seen. For more information, see:
|
||||
:rfc:`5656#section-4`.
|
||||
|
||||
|
||||
:c: The connection
|
||||
|
||||
|
||||
:is_orig: Did this message come from the originator?
|
||||
|
||||
|
||||
:q: The ephemeral public key
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh_capabilities ssh2_server_host_key
|
||||
ssh1_server_host_key ssh_server_host_key ssh_encrypted_packet
|
||||
ssh2_dh_server_params ssh2_gss_error
|
||||
|
||||
.. bro:id:: ssh2_gss_error
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, major_status: :bro:type:`count`, minor_status: :bro:type:`count`, err_msg: :bro:type:`string`)
|
||||
|
||||
In the event of a GSS-API error on the server, the server MAY send
|
||||
send an error message with some additional details. This event is
|
||||
generated when such an error message is seen. For more information,
|
||||
see :rfc:`4462#section-2.1`.
|
||||
|
||||
|
||||
:c: The connection.
|
||||
|
||||
|
||||
:major_status: GSS-API major status code.
|
||||
|
||||
|
||||
:minor_status: GSS-API minor status code.
|
||||
|
||||
|
||||
:err_msg: Detailed human-readable error message
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh_capabilities ssh2_server_host_key
|
||||
ssh1_server_host_key ssh_server_host_key ssh_encrypted_packet
|
||||
ssh2_dh_server_params ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh2_server_host_key
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, key: :bro:type:`string`)
|
||||
|
||||
During the :abbr:`SSH (Secure Shell)` key exchange, the server
|
||||
supplies its public host key. This event is generated when the
|
||||
appropriate key exchange message is seen for SSH2.
|
||||
|
||||
|
||||
:c: The connection over which the :abbr:`SSH (Secure Shell)`
|
||||
connection took place.
|
||||
|
||||
|
||||
:key: The server's public host key. Note that this is the public key
|
||||
itself, and not just the fingerprint or hash.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh_capabilities ssh1_server_host_key
|
||||
ssh_server_host_key ssh_encrypted_packet ssh2_dh_server_params
|
||||
ssh2_gss_error ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh_auth_attempted
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, authenticated: :bro:type:`bool`)
|
||||
|
||||
This event is generated when an :abbr:`SSH (Secure Shell)`
|
||||
connection was determined to have had an authentication attempt.
|
||||
This determination is based on packet size analysis, and errs
|
||||
on the side of caution - that is, if there's any doubt about
|
||||
whether or not an authenication attempt occured, this event is
|
||||
*not* raised.
|
||||
|
||||
At this point in the protocol, all we can determine is whether
|
||||
or not the user is authenticated. We don't know if the particular
|
||||
attempt succeeded or failed, since some servers require multiple
|
||||
authentications (e.g. require both a password AND a pubkey), and
|
||||
could return an authentication failed message which is marked
|
||||
as a partial success.
|
||||
|
||||
This event will often be raised multiple times per connection.
|
||||
In almost all connections, it will be raised once unless
|
||||
|
||||
|
||||
:c: The connection over which the :abbr:`SSH (Secure Shell)`
|
||||
connection took place.
|
||||
|
||||
|
||||
:authenticated: This is true if the analyzer detected a
|
||||
successful connection from the authentication attempt.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_capabilities ssh2_server_host_key ssh1_server_host_key
|
||||
ssh_server_host_key ssh_encrypted_packet ssh2_dh_server_params
|
||||
ssh2_gss_error ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh_auth_successful
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, auth_method_none: :bro:type:`bool`)
|
||||
|
||||
This event is generated when an :abbr:`SSH (Secure Shell)`
|
||||
connection was determined to have had a successful
|
||||
authentication. This determination is based on packet size
|
||||
analysis, and errs on the side of caution - that is, if there's any
|
||||
doubt about the authentication success, this event is *not* raised.
|
||||
|
||||
|
||||
:c: The connection over which the :abbr:`SSH (Secure Shell)`
|
||||
connection took place.
|
||||
|
||||
|
||||
:auth_method_none: This is true if the analyzer detected a
|
||||
successful connection before any authentication challenge. The
|
||||
:abbr:`SSH (Secure Shell)` protocol provides a mechanism for
|
||||
unauthenticated access, which some servers support.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version ssh_auth_failed
|
||||
ssh_auth_result ssh_auth_attempted ssh_capabilities
|
||||
ssh2_server_host_key ssh1_server_host_key ssh_server_host_key
|
||||
ssh_encrypted_packet ssh2_dh_server_params ssh2_gss_error
|
||||
ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh_capabilities
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, cookie: :bro:type:`string`, capabilities: :bro:type:`SSH::Capabilities`)
|
||||
|
||||
During the initial :abbr:`SSH (Secure Shell)` key exchange, each
|
||||
endpoint lists the algorithms that it supports, in order of
|
||||
preference. This event is generated for each endpoint, when the
|
||||
SSH_MSG_KEXINIT message is seen. See :rfc:`4253#section-7.1` for
|
||||
details.
|
||||
|
||||
|
||||
:c: The connection over which the :abbr:`SSH (Secure Shell)`
|
||||
connection took place.
|
||||
|
||||
|
||||
:cookie: The SSH_MSG_KEXINIT cookie - a random value generated by
|
||||
the sender.
|
||||
|
||||
|
||||
:capabilities: The list of algorithms and languages that the sender
|
||||
advertises support for, in order of preference.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh2_server_host_key ssh1_server_host_key
|
||||
ssh_server_host_key ssh_encrypted_packet ssh2_dh_server_params
|
||||
ssh2_gss_error ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh_client_version
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, version: :bro:type:`string`)
|
||||
|
||||
An :abbr:`SSH (Secure Shell)` Protocol Version Exchange message
|
||||
from the client. This contains an identification string that's used
|
||||
for version identification. See :rfc:`4253#section-4.2` for
|
||||
details.
|
||||
|
||||
|
||||
:c: The connection over which the message was sent.
|
||||
|
||||
|
||||
:version: The identification string
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_auth_successful ssh_auth_failed
|
||||
ssh_auth_result ssh_auth_attempted ssh_capabilities
|
||||
ssh2_server_host_key ssh1_server_host_key ssh_server_host_key
|
||||
ssh_encrypted_packet ssh2_dh_server_params ssh2_gss_error
|
||||
ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh_encrypted_packet
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, orig: :bro:type:`bool`, len: :bro:type:`count`)
|
||||
|
||||
This event is generated when an :abbr:`SSH (Secure Shell)`
|
||||
encrypted packet is seen. This event is not handled by default, but
|
||||
is provided for heuristic analysis scripts. Note that you have to set
|
||||
:bro:id:`SSH::disable_analyzer_after_detection` to false to use this
|
||||
event. This carries a performance penalty.
|
||||
|
||||
|
||||
:c: The connection over which the :abbr:`SSH (Secure Shell)`
|
||||
connection took place.
|
||||
|
||||
|
||||
:orig: Whether the packet was sent by the originator of the TCP
|
||||
connection.
|
||||
|
||||
|
||||
:len: The length of the :abbr:`SSH (Secure Shell)` payload, in
|
||||
bytes. Note that this ignores reassembly, as this is unknown.
|
||||
|
||||
.. bro:see:: ssh_server_version ssh_client_version
|
||||
ssh_auth_successful ssh_auth_failed ssh_auth_result
|
||||
ssh_auth_attempted ssh_capabilities ssh2_server_host_key
|
||||
ssh1_server_host_key ssh_server_host_key ssh2_dh_server_params
|
||||
ssh2_gss_error ssh2_ecc_key
|
||||
|
||||
.. bro:id:: ssh_server_version
|
||||
|
||||
:Type: :bro:type:`event` (c: :bro:type:`connection`, version: :bro:type:`string`)
|
||||
|
||||
An :abbr:`SSH (Secure Shell)` Protocol Version Exchange message
|
||||
from the server. This contains an identification string that's used
|
||||
for version identification. See :rfc:`4253#section-4.2` for
|
||||
details.
|
||||
|
||||
|
||||
:c: The connection over which the message was sent.
|
||||
|
||||
|
||||
:version: The identification string
|
||||
|
||||
.. bro:see:: ssh_client_version ssh_auth_successful ssh_auth_failed
|
||||
ssh_auth_result ssh_auth_attempted ssh_capabilities
|
||||
ssh2_server_host_key ssh1_server_host_key ssh_server_host_key
|
||||
ssh_encrypted_packet ssh2_dh_server_params ssh2_gss_error
|
||||
ssh2_ecc_key
|
||||
|
||||
|
||||
16
doc/scripts/base/bif/plugins/Bro_SSH.types.bif.bro.rst
Normal file
16
doc/scripts/base/bif/plugins/Bro_SSH.types.bif.bro.rst
Normal file
|
|
@ -0,0 +1,16 @@
|
|||
:tocdepth: 3
|
||||
|
||||
base/bif/plugins/Bro_SSH.types.bif.bro
|
||||
======================================
|
||||
.. bro:namespace:: GLOBAL
|
||||
.. bro:namespace:: SSH
|
||||
|
||||
|
||||
:Namespaces: GLOBAL, SSH
|
||||
|
||||
Summary
|
||||
~~~~~~~
|
||||
|
||||
Detailed Interface
|
||||
~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Add a link
Reference in a new issue