Merge remote-tracking branch 'origin/topic/seth/zeek_init'

* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
This commit is contained in:
Jon Siwek 2019-04-19 11:16:35 -07:00
commit a994be9eeb
628 changed files with 868 additions and 1082 deletions

View file

@ -86,7 +86,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, r: Conn::Inf
print outfile, |r$tunnel_parents|; # to make sure I got empty right
}
event bro_init()
event zeek_init()
{
local config_strings: table[string] of string = {
["query"] = "select * from conn;",

View file

@ -79,7 +79,7 @@ event term_me()
terminate();
}
event bro_init()
event zeek_init()
{
local config_strings: table[string] of string = {
["query"] = "select * from ssh;",

View file

@ -35,7 +35,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, p: port)
print outfile, p;
}
event bro_init()
event zeek_init()
{
local config_strings: table[string] of string = {
["query"] = "select port as p, proto from port;",

View file

@ -73,7 +73,7 @@ event line(description: Input::EventDescription, tpe: Input::Event, p: SSH::Log)
print outfile, |p$vs|;
}
event bro_init()
event zeek_init()
{
local config_strings: table[string] of string = {
["query"] = "select * from ssh;",