mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
FileAnalysis: finish switching hooks to events.
This commit is contained in:
parent
641154f8e8
commit
a2d9b47bcd
39 changed files with 219 additions and 305 deletions
|
@ -231,42 +231,6 @@ module FileAnalysis;
|
|||
|
||||
type ActionArgs: record;
|
||||
|
||||
## An enumeration of significant things that can occur over the course of
|
||||
## analyzing files. The :bro:see:`FileAnalysis::policy` hook is called each
|
||||
## time a trigger occurs.
|
||||
enum Trigger %{
|
||||
|
||||
## Raised when any part of a new file is detected.
|
||||
TRIGGER_NEW,
|
||||
|
||||
## Raised when file is detected being transported over a new network
|
||||
## connection (other than the first).
|
||||
TRIGGER_NEW_CONN,
|
||||
|
||||
## Raised when file analysis for a given file is aborted due
|
||||
## to not seeing any data for it recently. Note that this doesn't
|
||||
## necessarily mean the full file wasn't seen (e.g. if the
|
||||
## :bro:see:`fa_file` record indicates the file *total_bytes*
|
||||
## isn't known). Use :bro:see:`FileAnalysis::postpone_timeout`
|
||||
## during a :bro:see:`FileAnalysis::policy` handler for this trigger to
|
||||
## defer the timeout until later.
|
||||
TRIGGER_TIMEOUT,
|
||||
|
||||
## Raised when the beginning of a file is detected.
|
||||
TRIGGER_BOF,
|
||||
|
||||
## Raised when the beginning of a file is available in the *bof_buffer*
|
||||
## field of :bro:see:`fa_file` and that beginning
|
||||
## is at least the number of bytes indicated by the *bof_buffer_size* field.
|
||||
TRIGGER_BOF_BUFFER,
|
||||
|
||||
## Raised when an initial guess at the file/mime type of a file is matched.
|
||||
TRIGGER_TYPE,
|
||||
|
||||
## Raised when there's a missing chunk of data in the file stream.
|
||||
TRIGGER_GAP,
|
||||
%}
|
||||
|
||||
## An enumeration of various file analysis actions that can be taken.
|
||||
enum Action %{
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue