mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Updating baselines.
This commit is contained in:
parent
170a8bd403
commit
871561939b
4 changed files with 4 additions and 8 deletions
|
@ -1,2 +1,2 @@
|
||||||
# b i e c p sn n a d t iv s sc ss se
|
# b i e c p sn n a d t iv s sc ss se
|
||||||
T -42 SSH::SSH 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1299722788.39808 100.0 hurz 4,2,3,1 AA,BB,CC EMPTY
|
T -42 SSH::SSH 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1299727902.65854 100.0 hurz 4,1,3,2 CC,BB,AA EMPTY
|
||||||
|
|
|
@ -1,2 +1,2 @@
|
||||||
# b i e c p sn n a d t iv s sc ss se
|
# b i e c p sn n a d t iv s sc ss se
|
||||||
T -42 SSH::SSH 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1299722790.49273 100.0 hurz 2,1,4,3 BB,AA,CC EMPTY
|
T -42 SSH::SSH 21 123 10.0.0.0/24 10.0.0.0 1.2.3.4 3.14 1299727493.47095 100.0 hurz 4,1,3,2 CC,BB,AA EMPTY
|
||||||
|
|
|
@ -38,11 +38,9 @@ export {
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
global log_ssh: event(rec: Log);
|
|
||||||
|
|
||||||
event bro_init()
|
event bro_init()
|
||||||
{
|
{
|
||||||
Log::create_stream(SSH, [$columns=Log, $ev=log_ssh]);
|
Log::create_stream(SSH, [$columns=Log]);
|
||||||
}
|
}
|
||||||
|
|
||||||
#####
|
#####
|
||||||
|
|
|
@ -28,11 +28,9 @@ export {
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
global log_ssh: event(rec: Log);
|
|
||||||
|
|
||||||
event bro_init()
|
event bro_init()
|
||||||
{
|
{
|
||||||
Log::create_stream(SSH, [$columns=Log, $ev=log_ssh]);
|
Log::create_stream(SSH, [$columns=Log]);
|
||||||
Log::add_filter(SSH, [$name="f1", $path="ssh.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
|
Log::add_filter(SSH, [$name="f1", $path="ssh.success", $pred=function(rec: Log): bool { return rec$status == "success"; }]);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue