Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/seth/zeek_init'

Browse source 
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
This commit is contained in:
Jon Siwek 2019-04-19 11:16:35 -07:00
commit a994be9eeb
628 changed files with 868 additions and 1082 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/policy/frameworks/intel/removal.zeek
View file

@ -38,9 +38,9 @@ event Intel::log_intel(rec: Intel::Info)
terminate();
}
event bro_init() &priority=-10
event zeek_init() &priority=-10
{
Intel::insert([$indicator="10.0.0.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
Intel::insert([$indicator="10.0.0.2", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
schedule 1sec { do_it() };
}
}

2
testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek
View file

@ -17,7 +17,7 @@ www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distrib
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek
View file

@ -11,7 +11,7 @@ pythonfile Intel::FILE_NAME source1 test entry http://some-data-distributor.com/
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek
View file

@ -16,7 +16,7 @@ name-addr@example.com Intel::EMAIL source1 test entry http://some-data-distribut
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek
View file

@ -23,7 +23,7 @@ redef Intel::read_files += {
global total_files_read = 0;
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/software/version-changes.zeek
View file

@ -34,7 +34,7 @@ event new_software()
event new_software();
}
event bro_init()
event zeek_init()
{
event new_software();
}

2
testing/btest/scripts/policy/frameworks/software/vulnerable.zeek
View file

@ -11,7 +11,7 @@ redef Software::vulnerable_versions += {
["Java"] = set(java_1_6_vuln, java_1_7_vuln)
};
event bro_init()
event zeek_init()
{
Software::found([$orig_h=1.2.3.4, $orig_p=1234/tcp, $resp_h=4.3.2.1, $resp_p=80/tcp],
[$name="Java", $host=1.2.3.4, $version=[$major=1, $minor=7, $minor2=0, $minor3=15]]);