Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/seth/zeek_init'

Browse source 
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
This commit is contained in:
Jon Siwek 2019-04-19 11:16:35 -07:00
commit a994be9eeb
628 changed files with 868 additions and 1082 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/policy/frameworks/intel/removal.zeek
View file

@ -38,9 +38,9 @@ event Intel::log_intel(rec: Intel::Info)
terminate();
}
event bro_init() &priority=-10
event zeek_init() &priority=-10
{
Intel::insert([$indicator="10.0.0.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
Intel::insert([$indicator="10.0.0.2", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
schedule 1sec { do_it() };
}
}

2
testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek
View file

@ -17,7 +17,7 @@ www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distrib
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek
View file

@ -11,7 +11,7 @@ pythonfile Intel::FILE_NAME source1 test entry http://some-data-distributor.com/
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek
View file

@ -16,7 +16,7 @@ name-addr@example.com Intel::EMAIL source1 test entry http://some-data-distribut
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek
View file

@ -23,7 +23,7 @@ redef Intel::read_files += {
global total_files_read = 0;
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/software/version-changes.zeek
View file

@ -34,7 +34,7 @@ event new_software()
event new_software();
}
event bro_init()
event zeek_init()
{
event new_software();
}

2
testing/btest/scripts/policy/frameworks/software/vulnerable.zeek
View file

@ -11,7 +11,7 @@ redef Software::vulnerable_versions += {
["Java"] = set(java_1_6_vuln, java_1_7_vuln)
};
event bro_init()
event zeek_init()
{
Software::found([$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=4.3.2.1, $resp_p=80/tcp],
[$name="Java", $host=1.2.3.4, $version=[$major=1, $minor=7, $minor2=0, $minor3=15]]);

2
testing/btest/scripts/policy/misc/weird-stats.zeek
View file

@ -24,7 +24,7 @@ event gen_weirds(n: count, done: bool &default = F)
schedule 5sec { die() };
}
event bro_init()
event zeek_init()
{
event gen_weirds(1000);
schedule 7.5sec { gen_weirds(2000) } ;

4
testing/btest/scripts/policy/protocols/http/test-sql-injection-regex.zeek
View file

@ -3,8 +3,8 @@
@load protocols/http/detect-sqli
event bro_init ()
{
event zeek_init()
{
local positive_matches: set[string];
local negative_matches: set[string];