mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 03:58:20 +00:00
Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-improvements-2.4
This commit is contained in:
Daniel Thayer
commit
9cde2be727
653 changed files with 25848 additions and 7940 deletions
1
scripts/base/frameworks/broker/__load__.bro
Normal file
1
scripts/base/frameworks/broker/__load__.bro
Normal file
|
|
@ -0,0 +1 @@
|
|||
@load ./main
|
||||
103
scripts/base/frameworks/broker/main.bro
Normal file
103
scripts/base/frameworks/broker/main.bro
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
##! Various data structure definitions for use with Bro's communication system.
|
||||
|
||||
module BrokerComm;
|
||||
|
||||
export {
|
||||
|
||||
## A name used to identify this endpoint to peers.
|
||||
## .. bro:see:: BrokerComm::connect BrokerComm::listen
|
||||
const endpoint_name = "" &redef;
|
||||
|
||||
## Change communication behavior.
|
||||
type EndpointFlags: record {
|
||||
## Whether to restrict message topics that can be published to peers.
|
||||
auto_publish: bool &default = T;
|
||||
## Whether to restrict what message topics or data store identifiers
|
||||
## the local endpoint advertises to peers (e.g. subscribing to
|
||||
## events or making a master data store available).
|
||||
auto_advertise: bool &default = T;
|
||||
};
|
||||
|
||||
## Fine-grained tuning of communication behavior for a particular message.
|
||||
type SendFlags: record {
|
||||
## Send the message to the local endpoint.
|
||||
self: bool &default = F;
|
||||
## Send the message to peer endpoints that advertise interest in
|
||||
## the topic associated with the message.
|
||||
peers: bool &default = T;
|
||||
## Send the message to peer endpoints even if they don't advertise
|
||||
## interest in the topic associated with the message.
|
||||
unsolicited: bool &default = F;
|
||||
};
|
||||
|
||||
## Opaque communication data.
|
||||
type Data: record {
|
||||
d: opaque of BrokerComm::Data &optional;
|
||||
};
|
||||
|
||||
## Opaque communication data.
|
||||
type DataVector: vector of BrokerComm::Data;
|
||||
|
||||
## Opaque event communication data.
|
||||
type EventArgs: record {
|
||||
## The name of the event. Not set if invalid event or arguments.
|
||||
name: string &optional;
|
||||
## The arguments to the event.
|
||||
args: DataVector;
|
||||
};
|
||||
|
||||
## Opaque communication data used as a convenient way to wrap key-value
|
||||
## pairs that comprise table entries.
|
||||
type TableItem : record {
|
||||
key: BrokerComm::Data;
|
||||
val: BrokerComm::Data;
|
||||
};
|
||||
}
|
||||
|
||||
module BrokerStore;
|
||||
|
||||
export {
|
||||
|
||||
## Whether a data store query could be completed or not.
|
||||
type QueryStatus: enum {
|
||||
SUCCESS,
|
||||
FAILURE,
|
||||
};
|
||||
|
||||
## An expiry time for a key-value pair inserted in to a data store.
|
||||
type ExpiryTime: record {
|
||||
## Absolute point in time at which to expire the entry.
|
||||
absolute: time &optional;
|
||||
## A point in time relative to the last modification time at which
|
||||
## to expire the entry. New modifications will delay the expiration.
|
||||
since_last_modification: interval &optional;
|
||||
};
|
||||
|
||||
## The result of a data store query.
|
||||
type QueryResult: record {
|
||||
## Whether the query completed or not.
|
||||
status: BrokerStore::QueryStatus;
|
||||
## The result of the query. Certain queries may use a particular
|
||||
## data type (e.g. querying store size always returns a count, but
|
||||
## a lookup may return various data types).
|
||||
result: BrokerComm::Data;
|
||||
};
|
||||
|
||||
## Options to tune the SQLite storage backend.
|
||||
type SQLiteOptions: record {
|
||||
## File system path of the database.
|
||||
path: string &default = "store.sqlite";
|
||||
};
|
||||
|
||||
## Options to tune the RocksDB storage backend.
|
||||
type RocksDBOptions: record {
|
||||
## File system path of the database.
|
||||
path: string &default = "store.rocksdb";
|
||||
};
|
||||
|
||||
## Options to tune the particular storage backends.
|
||||
type BackendOptions: record {
|
||||
sqlite: SQLiteOptions &default = SQLiteOptions();
|
||||
rocksdb: RocksDBOptions &default = RocksDBOptions();
|
||||
};
|
||||
}
|
||||
|
|
@ -159,5 +159,5 @@ event bro_init() &priority=5
|
|||
terminate();
|
||||
}
|
||||
|
||||
Log::create_stream(Cluster::LOG, [$columns=Info]);
|
||||
Log::create_stream(Cluster::LOG, [$columns=Info, $path="cluster"]);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -164,7 +164,7 @@ const src_names = {
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Communication::LOG, [$columns=Info]);
|
||||
Log::create_stream(Communication::LOG, [$columns=Info, $path="communication"]);
|
||||
}
|
||||
|
||||
function do_script_log_common(level: count, src: count, msg: string)
|
||||
|
|
|
|||
|
|
@ -38,7 +38,7 @@ redef record connection += {
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(DPD::LOG, [$columns=Info]);
|
||||
Log::create_stream(DPD::LOG, [$columns=Info, $path="dpd"]);
|
||||
}
|
||||
|
||||
event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=10
|
||||
|
|
|
|||
|
|
@ -1,3 +1,9 @@
|
|||
@load-sigs ./archive
|
||||
@load-sigs ./audio
|
||||
@load-sigs ./font
|
||||
@load-sigs ./general
|
||||
@load-sigs ./image
|
||||
@load-sigs ./msoffice
|
||||
@load-sigs ./libmagic
|
||||
@load-sigs ./video
|
||||
|
||||
@load-sigs ./libmagic
|
||||
176
scripts/base/frameworks/files/magic/archive.sig
Normal file
176
scripts/base/frameworks/files/magic/archive.sig
Normal file
|
|
@ -0,0 +1,176 @@
|
|||
|
||||
signature file-tar {
|
||||
file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/
|
||||
file-mime "application/x-tar", 100
|
||||
}
|
||||
|
||||
# This is low priority so that files using zip as a
|
||||
# container will be identified correctly.
|
||||
signature file-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x03\x04.{2}/
|
||||
}
|
||||
|
||||
# Multivolume Zip archive
|
||||
signature file-multi-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x07\x08PK\x03\x04/
|
||||
}
|
||||
|
||||
# RAR
|
||||
signature file-rar {
|
||||
file-mime "application/x-rar", 70
|
||||
file-magic /^Rar!/
|
||||
}
|
||||
|
||||
# GZIP
|
||||
signature file-gzip {
|
||||
file-mime "application/x-gzip", 100
|
||||
file-magic /\x1f\x8b/
|
||||
}
|
||||
|
||||
# Microsoft Cabinet
|
||||
signature file-ms-cab {
|
||||
file-mime "application/vnd.ms-cab-compressed", 110
|
||||
file-magic /^MSCF\x00\x00\x00\x00/
|
||||
}
|
||||
|
||||
# Mac OS X DMG files
|
||||
signature file-dmg {
|
||||
file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/
|
||||
file-mime "application/x-dmg", 100
|
||||
}
|
||||
|
||||
# XAR (eXtensible ARchive) format.
|
||||
# Mac OS X uses this for the .pkg format.
|
||||
signature file-xar {
|
||||
file-magic /^xar\!/
|
||||
file-mime "application/x-xar", 100
|
||||
}
|
||||
|
||||
# RPM
|
||||
signature file-magic-auto352 {
|
||||
file-mime "application/x-rpm", 70
|
||||
file-magic /^(drpm|\xed\xab\xee\xdb)/
|
||||
}
|
||||
|
||||
# StuffIt
|
||||
signature file-stuffit {
|
||||
file-mime "application/x-stuffit", 70
|
||||
file-magic /^(SIT\x21|StuffIt)/
|
||||
}
|
||||
|
||||
# Archived data
|
||||
signature file-x-archive {
|
||||
file-mime "application/x-archive", 70
|
||||
file-magic /^!?<ar(ch)?>/
|
||||
}
|
||||
|
||||
# ARC archive data
|
||||
signature file-arc {
|
||||
file-mime "application/x-arc", 70
|
||||
file-magic /^[\x00-\x7f]{2}[\x02-\x0a\x14\x48]\x1a/
|
||||
}
|
||||
|
||||
# EET archive
|
||||
signature file-eet {
|
||||
file-mime "application/x-eet", 70
|
||||
file-magic /^\x1e\xe7\xff\x00/
|
||||
}
|
||||
|
||||
# Zoo archive
|
||||
signature file-zoo {
|
||||
file-mime "application/x-zoo", 70
|
||||
file-magic /^.{20}\xdc\xa7\xc4\xfd/
|
||||
}
|
||||
|
||||
# LZ4 compressed data (legacy format)
|
||||
signature file-lz4-legacy {
|
||||
file-mime "application/x-lz4", 70
|
||||
file-magic /(\x02\x21\x4c\x18)/
|
||||
}
|
||||
|
||||
# LZ4 compressed data
|
||||
signature file-lz4 {
|
||||
file-mime "application/x-lz4", 70
|
||||
file-magic /^\x04\x22\x4d\x18/
|
||||
}
|
||||
|
||||
# LRZIP compressed data
|
||||
signature file-lrzip {
|
||||
file-mime "application/x-lrzip", 1
|
||||
file-magic /^LRZI/
|
||||
}
|
||||
|
||||
# LZIP compressed data
|
||||
signature file-lzip {
|
||||
file-mime "application/x-lzip", 70
|
||||
file-magic /^LZIP/
|
||||
}
|
||||
|
||||
# Self-extracting PKZIP archive
|
||||
signature file-magic-auto434 {
|
||||
file-mime "application/zip", 340
|
||||
file-magic /^MZ.{28}(Copyright 1989\x2d1990 PKWARE Inc|PKLITE Copr)\x2e/
|
||||
}
|
||||
|
||||
# LHA archive (LZH)
|
||||
signature file-lzh {
|
||||
file-mime "application/x-lzh", 80
|
||||
file-magic /^.{2}-(lh[ abcdex0-9]|lz[s2-8]|lz[s2-8]|pm[s012]|pc1)-/
|
||||
}
|
||||
|
||||
# WARC Archive
|
||||
signature file-warc {
|
||||
file-mime "application/warc", 50
|
||||
file-magic /^WARC\x2f/
|
||||
}
|
||||
|
||||
# 7-zip archive data
|
||||
signature file-7zip {
|
||||
file-mime "application/x-7z-compressed", 50
|
||||
file-magic /^7z\xbc\xaf\x27\x1c/
|
||||
}
|
||||
|
||||
# XZ compressed data
|
||||
signature file-xz {
|
||||
file-mime "application/x-xz", 90
|
||||
file-magic /^\xfd7zXZ\x00/
|
||||
}
|
||||
|
||||
# LHa self-extracting archive
|
||||
signature file-magic-auto436 {
|
||||
file-mime "application/x-lha", 120
|
||||
file-magic /^MZ.{34}LH[aA]\x27s SFX/
|
||||
}
|
||||
|
||||
# ARJ archive data
|
||||
signature file-arj {
|
||||
file-mime "application/x-arj", 50
|
||||
file-magic /^\x60\xea/
|
||||
}
|
||||
|
||||
# Byte-swapped cpio archive
|
||||
signature file-bs-cpio {
|
||||
file-mime "application/x-cpio", 50
|
||||
file-magic /(\x71\xc7|\xc7\x71)/
|
||||
}
|
||||
|
||||
# CPIO archive
|
||||
signature file-cpio {
|
||||
file-mime "application/x-cpio", 50
|
||||
file-magic /^(\xc7\x71|\x71\xc7)/
|
||||
}
|
||||
|
||||
# Compress'd data
|
||||
signature file-compress {
|
||||
file-mime "application/x-compress", 50
|
||||
file-magic /^\x1f\x9d/
|
||||
}
|
||||
|
||||
# LZMA compressed data
|
||||
signature file-lzma {
|
||||
file-mime "application/x-lzma", 71
|
||||
file-magic /^\x5d\x00\x00/
|
||||
}
|
||||
|
||||
13
scripts/base/frameworks/files/magic/audio.sig
Normal file
13
scripts/base/frameworks/files/magic/audio.sig
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
|
||||
# MPEG v3 audio
|
||||
signature file-mpeg-audio {
|
||||
file-mime "audio/mpeg", 20
|
||||
file-magic /^\xff[\xe2\xe3\xf2\xf3\xf6\xf7\xfa\xfb\xfc\xfd]/
|
||||
}
|
||||
|
||||
# MPEG v4 audio
|
||||
signature file-m4a {
|
||||
file-mime "audio/m4a", 70
|
||||
file-magic /^....ftyp(m4a)/
|
||||
}
|
||||
|
||||
41
scripts/base/frameworks/files/magic/font.sig
Normal file
41
scripts/base/frameworks/files/magic/font.sig
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
|
||||
# Web Open Font Format
|
||||
signature file-woff {
|
||||
file-magic /^wOFF/
|
||||
file-mime "application/font-woff", 70
|
||||
}
|
||||
|
||||
# TrueType font
|
||||
signature file-ttf {
|
||||
file-mime "application/x-font-ttf", 80
|
||||
file-magic /^\x00\x01\x00\x00\x00/
|
||||
}
|
||||
|
||||
signature file-embedded-opentype {
|
||||
file-mime "application/vnd.ms-fontobject", 50
|
||||
file-magic /^.{34}LP/
|
||||
}
|
||||
|
||||
# X11 SNF font
|
||||
signature file-snf {
|
||||
file-mime "application/x-font-sfn", 70
|
||||
file-magic /^(\x04\x00\x00\x00|\x00\x00\x00\x04).{100}(\x04\x00\x00\x00|\x00\x00\x00\x04)/
|
||||
}
|
||||
|
||||
# OpenType font
|
||||
signature file-opentype {
|
||||
file-mime "application/vnd.ms-opentype", 70
|
||||
file-magic /^OTTO/
|
||||
}
|
||||
|
||||
# FrameMaker Font file
|
||||
signature file-maker-screen-font {
|
||||
file-mime "application/x-mif", 190
|
||||
file-magic /^\x3cMakerScreenFont/
|
||||
}
|
||||
|
||||
# >0 string,=SplineFontDB: (len=13), ["Spline Font Database "], swap_endian=0
|
||||
signature file-spline-font-db {
|
||||
file-mime "application/vnd.font-fontforge-sfd", 160
|
||||
file-magic /^SplineFontDB\x3a/
|
||||
}
|
||||
|
|
@ -1,18 +1,87 @@
|
|||
# General purpose file magic signatures.
|
||||
|
||||
# Plaintext
|
||||
# (Including BOMs for UTF-8, 16, and 32)
|
||||
signature file-plaintext {
|
||||
file-magic /^([[:print:][:space:]]{10})/
|
||||
file-mime "text/plain", -20
|
||||
file-mime "text/plain", -20
|
||||
file-magic /^(\xef\xbb\xbf|(\x00\x00)?\xfe\xff|\xff\xfe(\x00\x00)?)?[[:space:]\x20-\x7E]{10}/
|
||||
}
|
||||
|
||||
signature file-tar {
|
||||
file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/
|
||||
file-mime "application/x-tar", 100
|
||||
signature file-json {
|
||||
file-mime "text/json", 1
|
||||
file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\{[\x0d\x0a[:blank:]]*(["][^"]{1,}["]|[a-zA-Z][a-zA-Z0-9\\_]*)[\x0d\x0a[:blank:]]*:[\x0d\x0a[:blank:]]*(["]|\[|\{|[0-9]|true|false)/
|
||||
}
|
||||
|
||||
signature file-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x03\x04.{2}/
|
||||
signature file-json2 {
|
||||
file-mime "text/json", 1
|
||||
file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\[[\x0d\x0a[:blank:]]*(((["][^"]{1,}["]|[0-9]{1,}(\.[0-9]{1,})?|true|false)[\x0d\x0a[:blank:]]*,)|\{|\[)[\x0d\x0a[:blank:]]*/
|
||||
}
|
||||
|
||||
# Match empty JSON documents.
|
||||
signature file-json3 {
|
||||
file-mime "text/json", 0
|
||||
file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*(\[\]|\{\})[\x0d\x0a[:blank:]]*$/
|
||||
}
|
||||
|
||||
signature file-xml {
|
||||
file-mime "application/xml", 10
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<\?xml /
|
||||
}
|
||||
|
||||
signature file-xhtml {
|
||||
file-mime "text/html", 100
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<(![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]|[hH][tT][mM][lL]|[mM][eE][tT][aA] {1,}[hH][tT][tT][pP]-[eE][qQ][uU][iI][vV])/
|
||||
}
|
||||
|
||||
signature file-html {
|
||||
file-mime "text/html", 49
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]/
|
||||
}
|
||||
|
||||
signature file-html2 {
|
||||
file-mime "text/html", 20
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<([hH][eE][aA][dD]|[hH][tT][mM][lL]|[tT][iI][tT][lL][eE]|[bB][oO][dD][yY])/
|
||||
}
|
||||
|
||||
signature file-rss {
|
||||
file-mime "text/rss", 90
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[rR][sS][sS]/
|
||||
}
|
||||
|
||||
signature file-atom {
|
||||
file-mime "text/atom", 100
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<([rR][sS][sS][^>]*xmlns:atom|[fF][eE][eE][dD][^>]*xmlns=["']?http:\/\/www.w3.org\/2005\/Atom["']?)/
|
||||
}
|
||||
|
||||
signature file-soap {
|
||||
file-mime "application/soap+xml", 49
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[sS][oO][aA][pP](-[eE][nN][vV])?:[eE][nN][vV][eE][lL][oO][pP][eE]/
|
||||
}
|
||||
|
||||
signature file-cross-domain-policy {
|
||||
file-mime "text/x-cross-domain-policy", 49
|
||||
file-magic /^([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<![dD][oO][cC][tT][yY][pP][eE] {1,}[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/
|
||||
}
|
||||
|
||||
signature file-cross-domain-policy2 {
|
||||
file-mime "text/x-cross-domain-policy", 49
|
||||
file-magic /^([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/
|
||||
}
|
||||
|
||||
signature file-xmlrpc {
|
||||
file-mime "application/xml-rpc", 49
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[mM][eE][tT][hH][oO][dD][rR][eE][sS][pP][oO][nN][sS][eE]>/
|
||||
}
|
||||
|
||||
signature file-coldfusion {
|
||||
file-mime "magnus-internal/cold-fusion", 20
|
||||
file-magic /^([\x0d\x0a[:blank:]]*(<!--.*-->)?)*<(CFPARAM|CFSET|CFIF)/
|
||||
}
|
||||
|
||||
# Microsoft LNK files
|
||||
signature file-lnk {
|
||||
file-mime "application/x-ms-shortcut", 49
|
||||
file-magic /^\x4C\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x10\x00\x00\x00\x46/
|
||||
}
|
||||
|
||||
signature file-jar {
|
||||
|
|
@ -21,8 +90,20 @@ signature file-jar {
|
|||
}
|
||||
|
||||
signature file-java-applet {
|
||||
file-magic /^\xca\xfe\xba\xbe...[\x2e-\x34]/
|
||||
file-mime "application/x-java-applet", 71
|
||||
file-magic /^\xca\xfe\xba\xbe...[\x2d-\x34]/
|
||||
}
|
||||
|
||||
# OCSP requests over HTTP.
|
||||
signature file-ocsp-request {
|
||||
file-magic /^.{11,19}\x06\x05\x2b\x0e\x03\x02\x1a/
|
||||
file-mime "application/ocsp-request", 71
|
||||
}
|
||||
|
||||
# OCSP responses over HTTP.
|
||||
signature file-ocsp-response {
|
||||
file-magic /^.{11,19}\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x01/
|
||||
file-mime "application/ocsp-response", 71
|
||||
}
|
||||
|
||||
# Shockwave flash
|
||||
|
|
@ -37,12 +118,6 @@ signature file-tnef {
|
|||
file-mime "application/vnd.ms-tnef", 100
|
||||
}
|
||||
|
||||
# Mac OS X DMG files
|
||||
signature file-dmg {
|
||||
file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/
|
||||
file-mime "application/x-dmg", 100
|
||||
}
|
||||
|
||||
# Mac OS X Mach-O executable
|
||||
signature file-mach-o {
|
||||
file-magic /^[\xce\xcf]\xfa\xed\xfe/
|
||||
|
|
@ -55,13 +130,6 @@ signature file-mach-o-universal {
|
|||
file-mime "application/x-mach-o-executable", 100
|
||||
}
|
||||
|
||||
# XAR (eXtensible ARchive) format.
|
||||
# Mac OS X uses this for the .pkg format.
|
||||
signature file-xar {
|
||||
file-magic /^xar\!/
|
||||
file-mime "application/x-xar", 100
|
||||
}
|
||||
|
||||
signature file-pkcs7 {
|
||||
file-magic /^MIME-Version:.*protocol=\"application\/pkcs7-signature\"/
|
||||
file-mime "application/pkcs7-signature", 100
|
||||
|
|
@ -79,16 +147,6 @@ signature file-jnlp {
|
|||
file-mime "application/x-java-jnlp-file", 100
|
||||
}
|
||||
|
||||
signature file-ico {
|
||||
file-magic /^\x00\x00\x01\x00/
|
||||
file-mime "image/x-icon", 70
|
||||
}
|
||||
|
||||
signature file-cur {
|
||||
file-magic /^\x00\x00\x02\x00/
|
||||
file-mime "image/x-cursor", 70
|
||||
}
|
||||
|
||||
signature file-pcap {
|
||||
file-magic /^(\xa1\xb2\xc3\xd4|\xd4\xc3\xb2\xa1)/
|
||||
file-mime "application/vnd.tcpdump.pcap", 70
|
||||
|
|
@ -119,7 +177,58 @@ signature file-python {
|
|||
file-mime "text/x-python", 60
|
||||
}
|
||||
|
||||
signature file-awk {
|
||||
file-mime "text/x-awk", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(g|n)?awk/
|
||||
}
|
||||
|
||||
signature file-tcl {
|
||||
file-mime "text/x-tcl", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(wish|tcl)/
|
||||
}
|
||||
|
||||
signature file-lua {
|
||||
file-mime "text/x-lua", 49
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?lua/
|
||||
}
|
||||
|
||||
signature file-javascript {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?node(js)?/
|
||||
}
|
||||
|
||||
signature file-javascript2 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^[\x0d\x0a[:blank:]]*<[sS][cC][rR][iI][pP][tT][[:blank:]]+([tT][yY][pP][eE]|[lL][aA][nN][gG][uU][aA][gG][eE])=['"]?([tT][eE][xX][tT]\/)?[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]/
|
||||
}
|
||||
|
||||
signature file-javascript3 {
|
||||
file-mime "application/javascript", 60
|
||||
# This seems to be a somewhat common idiom in javascript.
|
||||
file-magic /^[\x0d\x0a[:blank:]]*for \(;;\);/
|
||||
}
|
||||
|
||||
signature file-javascript4 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^[\x0d\x0a[:blank:]]*document\.write(ln)?[:blank:]?\(/
|
||||
}
|
||||
|
||||
signature file-javascript5 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^\(function\(\)[[:blank:]\n]*\{/
|
||||
}
|
||||
|
||||
signature file-javascript6 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^[\x0d\x0a[:blank:]]*<script>[\x0d\x0a[:blank:]]*(var|function) /
|
||||
}
|
||||
|
||||
signature file-php {
|
||||
file-mime "text/x-php", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?php/
|
||||
}
|
||||
|
||||
signature file-php2 {
|
||||
file-magic /^.*<\?php/
|
||||
file-mime "text/x-php", 40
|
||||
}
|
||||
|
|
@ -135,3 +244,23 @@ signature file-skp {
|
|||
file-magic /^\xFF\xFE\xFF\x0E\x53\x00\x6B\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4D\x00\x6F\x00\x64\x00\x65\x00\x6C\x00/
|
||||
file-mime "application/skp", 100
|
||||
}
|
||||
|
||||
signature file-elf-object {
|
||||
file-mime "application/x-object", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/
|
||||
}
|
||||
|
||||
signature file-elf {
|
||||
file-mime "application/x-executable", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x02\x00|\x02.{10}\x00\x02)/
|
||||
}
|
||||
|
||||
signature file-elf-sharedlib {
|
||||
file-mime "application/x-sharedlib", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x03\x00|\x02.{10}\x00\x03)/
|
||||
}
|
||||
|
||||
signature file-elf-coredump {
|
||||
file-mime "application/x-coredump", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x04\x00|\x02.{10}\x00\x04)/
|
||||
}
|
||||
|
|
|
|||
166
scripts/base/frameworks/files/magic/image.sig
Normal file
166
scripts/base/frameworks/files/magic/image.sig
Normal file
|
|
@ -0,0 +1,166 @@
|
|||
|
||||
signature file-tiff {
|
||||
file-mime "image/tiff", 70
|
||||
file-magic /^(MM\x00[\x2a\x2b]|II[\x2a\x2b]\x00)/
|
||||
}
|
||||
|
||||
signature file-gif {
|
||||
file-mime "image/gif", 70
|
||||
file-magic /^GIF8/
|
||||
}
|
||||
|
||||
# JPEG image
|
||||
signature file-jpeg {
|
||||
file-mime "image/jpeg", 52
|
||||
file-magic /^\xff\xd8/
|
||||
}
|
||||
|
||||
signature file-bmp {
|
||||
file-mime "image/x-ms-bmp", 50
|
||||
file-magic /BM.{12}[\x0c\x28\x40\x6c\x7c\x80]\x00/
|
||||
}
|
||||
|
||||
signature file-ico {
|
||||
file-magic /^\x00\x00\x01\x00/
|
||||
file-mime "image/x-icon", 70
|
||||
}
|
||||
|
||||
signature file-cur {
|
||||
file-magic /^\x00\x00\x02\x00/
|
||||
file-mime "image/x-cursor", 70
|
||||
}
|
||||
|
||||
signature file-magic-auto289 {
|
||||
file-mime "image/vnd.adobe.photoshop", 70
|
||||
file-magic /^8BPS/
|
||||
}
|
||||
|
||||
signature file-png {
|
||||
file-mime "image/png", 110
|
||||
file-magic /^\x89PNG/
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jp2 {
|
||||
file-mime "image/jp2", 60
|
||||
file-magic /.{4}ftypjp2/
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jp22 {
|
||||
file-mime "image/jp2", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jp2 /
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jpx {
|
||||
file-mime "image/jpx", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpx /
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jpm {
|
||||
file-mime "image/jpm", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpm /
|
||||
}
|
||||
|
||||
# Xcursor image
|
||||
signature file-x-cursor {
|
||||
file-mime "image/x-xcursor", 70
|
||||
file-magic /^Xcur/
|
||||
}
|
||||
|
||||
# NIFF image
|
||||
signature file-niff {
|
||||
file-mime "image/x-niff", 70
|
||||
file-magic /^IIN1/
|
||||
}
|
||||
|
||||
# OpenEXR image
|
||||
signature file-openexr {
|
||||
file-mime "image/x-exr", 70
|
||||
file-magic /^\x76\x2f\x31\x01/
|
||||
}
|
||||
|
||||
# DPX image
|
||||
signature file-dpx {
|
||||
file-mime "image/x-dpx", 70
|
||||
file-magic /^SDPX/
|
||||
}
|
||||
|
||||
# Cartesian Perceptual Compression image
|
||||
signature file-cpi {
|
||||
file-mime "image/x-cpi", 70
|
||||
file-magic /(CPC\xb2)/
|
||||
}
|
||||
|
||||
signature file-orf {
|
||||
file-mime "image/x-olympus-orf", 70
|
||||
file-magic /IIR[OS]|MMOR/
|
||||
}
|
||||
|
||||
# Foveon X3F raw image
|
||||
signature file-x3r {
|
||||
file-mime "image/x-x3f", 70
|
||||
file-magic /^FOVb/
|
||||
}
|
||||
|
||||
# Paint.NET image
|
||||
signature file-paint-net {
|
||||
file-mime "image/x-paintnet", 70
|
||||
file-magic /^PDN3/
|
||||
}
|
||||
|
||||
# Corel Draw Picture
|
||||
signature file-coreldraw {
|
||||
file-mime "image/x-coreldraw", 70
|
||||
file-magic /^RIFF....CDR[A6]/
|
||||
}
|
||||
|
||||
# Netpbm PAM image
|
||||
signature file-netbpm{
|
||||
file-mime "image/x-portable-pixmap", 50
|
||||
file-magic /^P7/
|
||||
}
|
||||
|
||||
# JPEG 2000 image
|
||||
signature file-jpeg-2000 {
|
||||
file-mime "image/jp2", 50
|
||||
file-magic /^....jP/
|
||||
}
|
||||
|
||||
# DjVU Images
|
||||
signature file-djvu {
|
||||
file-mime "image/vnd.djvu", 70
|
||||
file-magic /AT\x26TFORM.{4}(DJV[MUI]|THUM)/
|
||||
}
|
||||
|
||||
# DWG AutoDesk AutoCAD
|
||||
signature file-dwg {
|
||||
file-mime "image/vnd.dwg", 90
|
||||
file-magic /^(AC[12]\.|AC10)/
|
||||
}
|
||||
|
||||
# GIMP XCF image
|
||||
signature file-gimp-xcf {
|
||||
file-mime "image/x-xcf", 110
|
||||
file-magic /^gimp xcf/
|
||||
}
|
||||
|
||||
# Polar Monitor Bitmap text
|
||||
signature file-polar-monitor-bitmap {
|
||||
file-mime "image/x-polar-monitor-bitmap", 160
|
||||
file-magic /^\x5bBitmapInfo2\x5d/
|
||||
}
|
||||
|
||||
# Award BIOS bitmap
|
||||
signature file-award-bitmap {
|
||||
file-mime "image/x-award-bmp", 20
|
||||
file-magic /^AWBM/
|
||||
}
|
||||
|
||||
# Award BIOS Logo, 136 x 84
|
||||
signature file-award-bios-logo {
|
||||
file-mime "image/x-award-bioslogo", 50
|
||||
file-magic /^\x11[\x06\x09]/
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -26,3 +26,9 @@ signature file-pptx {
|
|||
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|ppt\x2f).*PK\x03\x04.{26}ppt\x2f/
|
||||
file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 80
|
||||
}
|
||||
|
||||
signature file-msaccess {
|
||||
file-mime "application/x-msaccess", 180
|
||||
file-magic /.{4}Standard (Jet|ACE) DB\x00/
|
||||
}
|
||||
|
||||
|
|
|
|||
96
scripts/base/frameworks/files/magic/video.sig
Normal file
96
scripts/base/frameworks/files/magic/video.sig
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
|
||||
# Macromedia Flash Video
|
||||
signature file-flv {
|
||||
file-mime "video/x-flv", 60
|
||||
file-magic /^FLV/
|
||||
}
|
||||
|
||||
# FLI animation
|
||||
signature file-fli {
|
||||
file-mime "video/x-fli", 50
|
||||
file-magic /^.{4}\x11\xaf/
|
||||
}
|
||||
|
||||
# FLC animation
|
||||
signature file-flc {
|
||||
file-mime "video/x-flc", 50
|
||||
file-magic /^.{4}\x12\xaf/
|
||||
}
|
||||
|
||||
# Motion JPEG 2000
|
||||
signature file-mj2 {
|
||||
file-mime "video/mj2", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}mjp2/
|
||||
}
|
||||
|
||||
# MNG video
|
||||
signature file-mng {
|
||||
file-mime "video/x-mng", 70
|
||||
file-magic /^\x8aMNG/
|
||||
}
|
||||
|
||||
# JNG video
|
||||
signature file-jng {
|
||||
file-mime "video/x-jng", 70
|
||||
file-magic /^\x8bJNG/
|
||||
}
|
||||
|
||||
# Generic MPEG container
|
||||
signature file-mpeg {
|
||||
file-mime "video/mpeg", 50
|
||||
file-magic /(\x00\x00\x01[\xb0-\xbb])/
|
||||
}
|
||||
|
||||
# MPV
|
||||
signature file-mpv {
|
||||
file-mime "video/mpv", 71
|
||||
file-magic /(\x00\x00\x01\xb3)/
|
||||
}
|
||||
|
||||
# H.264
|
||||
signature file-h264 {
|
||||
file-mime "video/h264", 41
|
||||
file-magic /(\x00\x00\x00\x01)([\x07\x27\x47\x67\x87\xa7\xc7\xe7])/
|
||||
}
|
||||
|
||||
# WebM video
|
||||
signature file-webm {
|
||||
file-mime "video/webm", 70
|
||||
file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(webm)/
|
||||
}
|
||||
|
||||
# Matroska video
|
||||
signature file-matroska {
|
||||
file-mime "video/x-matroska", 110
|
||||
file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(matroska)/
|
||||
}
|
||||
|
||||
# MP2P
|
||||
signature file-mp2p {
|
||||
file-mime "video/mp2p", 21
|
||||
file-magic /\x00\x00\x01\xba([\x40-\x7f\xc0-\xff])/
|
||||
}
|
||||
|
||||
# Silicon Graphics video
|
||||
signature file-sgi-movie {
|
||||
file-mime "video/x-sgi-movie", 70
|
||||
file-magic /^MOVI/
|
||||
}
|
||||
|
||||
# Apple QuickTime movie
|
||||
signature file-quicktime {
|
||||
file-mime "video/quicktime", 70
|
||||
file-magic /^....(mdat|moov)/
|
||||
}
|
||||
|
||||
# MPEG v4 video
|
||||
signature file-mp4 {
|
||||
file-mime "video/mp4", 70
|
||||
file-magic /^....ftyp(isom|mp4[12])/
|
||||
}
|
||||
|
||||
# 3GPP Video
|
||||
signature file-3gpp {
|
||||
file-mime "video/3gpp", 60
|
||||
file-magic /^....ftyp(3g[egps2]|avc1|mmp4)/
|
||||
}
|
||||
|
|
@ -129,12 +129,11 @@ export {
|
|||
## files based on the detected mime type of the file.
|
||||
const analyze_by_mime_type_automatically = T &redef;
|
||||
|
||||
## The default setting for if the file reassembler is enabled for
|
||||
## each file.
|
||||
## The default setting for file reassembly.
|
||||
const enable_reassembler = T &redef;
|
||||
|
||||
## The default per-file reassembly buffer size.
|
||||
const reassembly_buffer_size = 1048576 &redef;
|
||||
const reassembly_buffer_size = 524288 &redef;
|
||||
|
||||
## Allows the file reassembler to be used if it's necessary because the
|
||||
## file is transferred out of order.
|
||||
|
|
@ -313,7 +312,7 @@ global analyzer_add_callbacks: table[Files::Tag] of function(f: fa_file, args: A
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Files::LOG, [$columns=Info, $ev=log_files]);
|
||||
Log::create_stream(Files::LOG, [$columns=Info, $ev=log_files, $path="files"]);
|
||||
}
|
||||
|
||||
function set_info(f: fa_file)
|
||||
|
|
@ -484,16 +483,19 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
add f$info$rx_hosts[f$is_orig ? cid$resp_h : cid$orig_h];
|
||||
}
|
||||
|
||||
event file_mime_type(f: fa_file, mime_type: string) &priority=10
|
||||
event file_sniff(f: fa_file, meta: fa_metadata) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
|
||||
f$info$mime_type = mime_type;
|
||||
if ( ! meta?$mime_type )
|
||||
return;
|
||||
|
||||
f$info$mime_type = meta$mime_type;
|
||||
|
||||
if ( analyze_by_mime_type_automatically &&
|
||||
mime_type in mime_type_to_analyzers )
|
||||
meta$mime_type in mime_type_to_analyzers )
|
||||
{
|
||||
local analyzers = mime_type_to_analyzers[mime_type];
|
||||
local analyzers = mime_type_to_analyzers[meta$mime_type];
|
||||
for ( a in analyzers )
|
||||
{
|
||||
add f$info$analyzers[Files::analyzer_name(a)];
|
||||
|
|
|
|||
|
|
@ -32,6 +32,8 @@ export {
|
|||
FILE_NAME,
|
||||
## Certificate SHA-1 hash.
|
||||
CERT_HASH,
|
||||
## Public key MD5 hash. (SSH server host keys are a good example.)
|
||||
PUBKEY_HASH,
|
||||
};
|
||||
|
||||
## Data about an :bro:type:`Intel::Item`.
|
||||
|
|
@ -174,7 +176,7 @@ global min_data_store: MinDataStore &redef;
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(LOG, [$columns=Info, $ev=log_intel]);
|
||||
Log::create_stream(LOG, [$columns=Info, $ev=log_intel, $path="intel"]);
|
||||
}
|
||||
|
||||
function find(s: Seen): bool
|
||||
|
|
|
|||
|
|
@ -50,11 +50,17 @@ export {
|
|||
## The event receives a single same parameter, an instance of
|
||||
## type ``columns``.
|
||||
ev: any &optional;
|
||||
|
||||
## A path that will be inherited by any filters added to the
|
||||
## stream which do not already specify their own path.
|
||||
path: string &optional;
|
||||
};
|
||||
|
||||
## Builds the default path values for log filters if not otherwise
|
||||
## specified by a filter. The default implementation uses *id*
|
||||
## to derive a name.
|
||||
## to derive a name. Upon adding a filter to a stream, if neither
|
||||
## ``path`` nor ``path_func`` is explicitly set by them, then
|
||||
## this function is used as the ``path_func``.
|
||||
##
|
||||
## id: The ID associated with the log stream.
|
||||
##
|
||||
|
|
@ -144,7 +150,9 @@ export {
|
|||
## to compute the string dynamically. It is ok to return
|
||||
## different strings for separate calls, but be careful: it's
|
||||
## easy to flood the disk by returning a new string for each
|
||||
## connection.
|
||||
## connection. Upon adding a filter to a stream, if neither
|
||||
## ``path`` nor ``path_func`` is explicitly set by them, then
|
||||
## :bro:see:`default_path_func` is used.
|
||||
##
|
||||
## id: The ID associated with the log stream.
|
||||
##
|
||||
|
|
@ -380,6 +388,8 @@ export {
|
|||
global active_streams: table[ID] of Stream = table();
|
||||
}
|
||||
|
||||
global all_streams: table[ID] of Stream = table();
|
||||
|
||||
# We keep a script-level copy of all filters so that we can manipulate them.
|
||||
global filters: table[ID, string] of Filter;
|
||||
|
||||
|
|
@ -464,6 +474,7 @@ function create_stream(id: ID, stream: Stream) : bool
|
|||
return F;
|
||||
|
||||
active_streams[id] = stream;
|
||||
all_streams[id] = stream;
|
||||
|
||||
return add_default_filter(id);
|
||||
}
|
||||
|
|
@ -471,6 +482,7 @@ function create_stream(id: ID, stream: Stream) : bool
|
|||
function remove_stream(id: ID) : bool
|
||||
{
|
||||
delete active_streams[id];
|
||||
delete all_streams[id];
|
||||
return __remove_stream(id);
|
||||
}
|
||||
|
||||
|
|
@ -483,10 +495,12 @@ function disable_stream(id: ID) : bool
|
|||
|
||||
function add_filter(id: ID, filter: Filter) : bool
|
||||
{
|
||||
# This is a work-around for the fact that we can't forward-declare
|
||||
# the default_path_func and then use it as &default in the record
|
||||
# definition.
|
||||
if ( ! filter?$path_func )
|
||||
local stream = all_streams[id];
|
||||
|
||||
if ( stream?$path && ! filter?$path )
|
||||
filter$path = stream$path;
|
||||
|
||||
if ( ! filter?$path && ! filter?$path_func )
|
||||
filter$path_func = default_path_func;
|
||||
|
||||
filters[id, filter$name] = filter;
|
||||
|
|
|
|||
|
|
@ -37,6 +37,8 @@ export {
|
|||
user: string;
|
||||
## The remote host to which to transfer logs.
|
||||
host: string;
|
||||
## The port to connect to. Defaults to 22
|
||||
host_port: count &default=22;
|
||||
## The path/directory on the remote host to send logs.
|
||||
path: string;
|
||||
};
|
||||
|
|
@ -63,8 +65,8 @@ function sftp_postprocessor(info: Log::RotationInfo): bool
|
|||
{
|
||||
local dst = fmt("%s/%s.%s.log", d$path, info$path,
|
||||
strftime(Log::sftp_rotation_date_format, info$open));
|
||||
command += fmt("echo put %s %s | sftp -b - %s@%s;", info$fname, dst,
|
||||
d$user, d$host);
|
||||
command += fmt("echo put %s %s | sftp -P %d -b - %s@%s;", info$fname, dst,
|
||||
d$host_port, d$user, d$host);
|
||||
}
|
||||
|
||||
command += fmt("/bin/rm %s", info$fname);
|
||||
|
|
|
|||
|
|
@ -19,9 +19,9 @@ export {
|
|||
## the :bro:id:`NOTICE` function. The convention is to give a general
|
||||
## category along with the specific notice separating words with
|
||||
## underscores and using leading capitals on each word except for
|
||||
## abbreviations which are kept in all capitals. For example,
|
||||
## abbreviations which are kept in all capitals. For example,
|
||||
## SSH::Password_Guessing is for hosts that have crossed a threshold of
|
||||
## heuristically determined failed SSH logins.
|
||||
## failed SSH logins.
|
||||
type Type: enum {
|
||||
## Notice reporting a count of how often a notice occurred.
|
||||
Tally,
|
||||
|
|
@ -349,9 +349,9 @@ function log_mailing_postprocessor(info: Log::RotationInfo): bool
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice]);
|
||||
Log::create_stream(Notice::LOG, [$columns=Info, $ev=log_notice, $path="notice"]);
|
||||
|
||||
Log::create_stream(Notice::ALARM_LOG, [$columns=Notice::Info]);
|
||||
Log::create_stream(Notice::ALARM_LOG, [$columns=Notice::Info, $path="notice_alarm"]);
|
||||
# If Bro is configured for mailing notices, set up mailing for alarms.
|
||||
# Make sure that this alarm log is also output as text so that it can
|
||||
# be packaged up and emailed later.
|
||||
|
|
|
|||
|
|
@ -294,7 +294,7 @@ global current_conn: connection;
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird]);
|
||||
Log::create_stream(Weird::LOG, [$columns=Info, $ev=log_weird, $path="weird"]);
|
||||
}
|
||||
|
||||
function flow_id_string(src: addr, dst: addr): string
|
||||
|
|
|
|||
|
|
@ -159,7 +159,7 @@ event filter_change_tracking()
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(PacketFilter::LOG, [$columns=Info]);
|
||||
Log::create_stream(PacketFilter::LOG, [$columns=Info, $path="packet_filter"]);
|
||||
|
||||
# Preverify the capture and restrict filters to give more granular failure messages.
|
||||
for ( id in capture_filters )
|
||||
|
|
|
|||
|
|
@ -45,7 +45,7 @@ export {
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Reporter::LOG, [$columns=Info]);
|
||||
Log::create_stream(Reporter::LOG, [$columns=Info, $path="reporter"]);
|
||||
}
|
||||
|
||||
event reporter_info(t: time, msg: string, location: string) &priority=-5
|
||||
|
|
|
|||
|
|
@ -142,7 +142,7 @@ global did_sig_log: set[string] &read_expire = 1 hr;
|
|||
|
||||
event bro_init()
|
||||
{
|
||||
Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature]);
|
||||
Log::create_stream(Signatures::LOG, [$columns=Info, $ev=log_signature, $path="signatures"]);
|
||||
}
|
||||
|
||||
# Returns true if the given signature has already been triggered for the given
|
||||
|
|
@ -277,7 +277,7 @@ event signature_match(state: signature_state, msg: string, data: string)
|
|||
orig, sig_id, hcount);
|
||||
|
||||
Log::write(Signatures::LOG,
|
||||
[$note=Multiple_Sig_Responders,
|
||||
[$ts=network_time(), $note=Multiple_Sig_Responders,
|
||||
$src_addr=orig, $sig_id=sig_id, $event_msg=msg,
|
||||
$host_count=hcount, $sub_msg=horz_scan_msg]);
|
||||
|
||||
|
|
|
|||
|
|
@ -105,7 +105,7 @@ export {
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software]);
|
||||
Log::create_stream(Software::LOG, [$columns=Info, $ev=log_software, $path="software"]);
|
||||
}
|
||||
|
||||
type Description: record {
|
||||
|
|
|
|||
|
|
@ -89,7 +89,7 @@ redef likely_server_ports += { ayiya_ports, teredo_ports, gtpv1_ports };
|
|||
|
||||
event bro_init() &priority=5
|
||||
{
|
||||
Log::create_stream(Tunnel::LOG, [$columns=Info]);
|
||||
Log::create_stream(Tunnel::LOG, [$columns=Info, $path="tunnel"]);
|
||||
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_AYIYA, ayiya_ports);
|
||||
Analyzer::register_for_ports(Analyzer::ANALYZER_TEREDO, teredo_ports);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue