diff --git a/scripts/base/protocols/ssh/main.bro b/scripts/base/protocols/ssh/main.bro index ea5b60f002..7b38cdd406 100644 --- a/scripts/base/protocols/ssh/main.bro +++ b/scripts/base/protocols/ssh/main.bro @@ -58,12 +58,12 @@ export { } redef record Info += { - ## This connection has been logged (internal use) + # This connection has been logged (internal use) logged: bool &default=F; - ## Number of failures seen (internal use) + # Number of failures seen (internal use) num_failures: count &default=0; - ## Store capabilities from the first host for - ## comparison with the second (internal use) + # Store capabilities from the first host for + # comparison with the second (internal use) capabilities: Capabilities &optional; }; diff --git a/scripts/policy/protocols/ssh/detect-bruteforcing.bro b/scripts/policy/protocols/ssh/detect-bruteforcing.bro index ba889cbf3c..81631e6c4d 100644 --- a/scripts/policy/protocols/ssh/detect-bruteforcing.bro +++ b/scripts/policy/protocols/ssh/detect-bruteforcing.bro @@ -70,7 +70,7 @@ event bro_init() }]); } -event SSH::heuristic_successful_login(c: connection) +event SSH::ssh_auth_successful(c: connection, auth_method_none: bool) { local id = c$id; @@ -79,7 +79,7 @@ event SSH::heuristic_successful_login(c: connection) $where=SSH::SUCCESSFUL_LOGIN]); } -event SSH::heuristic_failed_login(c: connection) +event SSH::ssh_auth_failed(c: connection) { local id = c$id; diff --git a/scripts/policy/protocols/ssh/geo-data.bro b/scripts/policy/protocols/ssh/geo-data.bro index a5fed986ef..00b52058a1 100644 --- a/scripts/policy/protocols/ssh/geo-data.bro +++ b/scripts/policy/protocols/ssh/geo-data.bro @@ -30,7 +30,7 @@ function get_location(c: connection): geo_location return lookup_location(lookup_ip); } -event SSH::heuristic_successful_login(c: connection) &priority=5 +event SSH::ssh_auth_successful(c: connection, auth_method_none: bool) &priority=3 { # Add the location data to the SSH record. c$ssh$remote_location = get_location(c); @@ -45,7 +45,7 @@ event SSH::heuristic_successful_login(c: connection) &priority=5 } } -event SSH::heuristic_failed_login(c: connection) &priority=5 +event SSH::ssh_auth_failed(c: connection) &priority=3 { # Add the location data to the SSH record. c$ssh$remote_location = get_location(c); diff --git a/scripts/policy/protocols/ssh/interesting-hostnames.bro b/scripts/policy/protocols/ssh/interesting-hostnames.bro index f9b3636e62..e43349c030 100644 --- a/scripts/policy/protocols/ssh/interesting-hostnames.bro +++ b/scripts/policy/protocols/ssh/interesting-hostnames.bro @@ -27,7 +27,7 @@ export { /^ftp[0-9]*\./ &redef; } -event SSH::heuristic_successful_login(c: connection) +event SSH::ssh_auth_successful(c: connection, auth_method_none: bool) { for ( host in set(c$id$orig_h, c$id$resp_h) ) {