Small script refinements and documentation updates.

scripts/policy/protocols/ssh/detect-bruteforcing.bro

@@ -38,7 +38,8 @@ export {
 	const ignore_guessers: table[subnet] of subnet &redef;
 
 	## Keeps track of hosts identified as guessing passwords.
-	global password_guessers: set[addr] &read_expire=guessing_timeout+1hr &synchronized;
+	global password_guessers: set[addr] 
+		&read_expire=guessing_timeout+1hr &synchronized &redef;
 }
 
 event bro_init()

scripts/policy/protocols/ssh/geo-data.bro

@@ -1,8 +1,8 @@
 ##! This implements all of the additional information and geodata detections 
 ##! for SSH analysis.
 
-@load base/frameworks/notice/main
-@load base/protocols/ssh/main
+@load base/frameworks/notice
+@load base/protocols/ssh
 
 module SSH;
 
@@ -11,17 +11,17 @@ export {
 		## If an SSH login is seen to or from a "watched" country based on the
 		## :bro:id:`SSH::watched_countries` variable then this notice will
 		## be generated.
-		Login_From_Watched_Country,
+		Watched_Country_Login,
+	};
+	
+	redef record Info += {
+		## Add geographic data related to the "remote" host of the connection.
+		remote_location: geo_location &log &optional;
 	};
 	
 	## The set of countries for which you'd like to throw notices upon 
 	## successful login
 	const watched_countries: set[string] = {"RO"} &redef;
-
-	redef record Info += {
-		## Add geographic data related to the "remote" host of the connection.
-		remote_location: geo_location &log &optional;
-	};
 }
 
 event SSH::heuristic_successful_login(c: connection) &priority=5
@@ -35,8 +35,10 @@ event SSH::heuristic_successful_login(c: connection) &priority=5
 	
 	if ( location?$country_code && location$country_code in watched_countries )
 		{
-		NOTICE([$note=Login_From_Watched_Country,
+		NOTICE([$note=Watched_Country_Login,
 		        $conn=c,
-		        $msg=fmt("SSH login from watched country: %s", location$country_code)]);
+		        $msg=fmt("SSH login %s watched country: %s", 
+		                 (c$ssh$direction == OUTBOUND) ? "to" : "from", 
+		                 location$country_code)]);
 		}
 	}

scripts/policy/protocols/ssh/software.bro

@@ -1,4 +1,7 @@
-@load base/frameworks/software/main
+##! This script extracts SSH client and server information from SSH 
+##! connections and forwards it to the software framework.
+
+@load base/frameworks/software
 
 module SSH;