mirror of
https://github.com/zeek/zeek.git
synced 2025-10-16 13:38:19 +00:00
Updates for the Intel Framework.
- Intel importing format has changed (refer to docs). - All string matching is now case insensitive. - SMTP intel script has been updated to extract email addresses correctly. - Small fix sneaking into the smtp base script to actually extract individual email addresses in the To: field correctly.
This commit is contained in:
parent
18201afcf8
commit
9b444b2617
17 changed files with 178 additions and 166 deletions
|
@ -5,8 +5,8 @@
|
|||
event http_message_done(c: connection, is_orig: bool, stat: http_message_stat)
|
||||
{
|
||||
if ( is_orig && c?$http )
|
||||
Intel::seen([$str=HTTP::build_url(c$http),
|
||||
$str_type=Intel::URL,
|
||||
Intel::seen([$indicator=HTTP::build_url(c$http),
|
||||
$indicator_type=Intel::URL,
|
||||
$conn=c,
|
||||
$where=HTTP::IN_URL]);
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue