Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 11:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/seth/zeek_init'

Browse source 
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
This commit is contained in:
Jon Siwek 2019-04-19 11:16:35 -07:00
commit a994be9eeb
628 changed files with 868 additions and 1082 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/scripts/policy/frameworks/intel/removal.zeek
View file

@ -38,9 +38,9 @@ event Intel::log_intel(rec: Intel::Info)
terminate();
}
event bro_init() &priority=-10
event zeek_init() &priority=-10
{
Intel::insert([$indicator="10.0.0.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
Intel::insert([$indicator="10.0.0.2", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
schedule 1sec { do_it() };
}
}

2
testing/btest/scripts/policy/frameworks/intel/seen/certs.zeek
View file

@ -17,7 +17,7 @@ www.dresdner-privat.de Intel::DOMAIN source1 test entry http://some-data-distrib
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/seen/smb.zeek
View file

@ -11,7 +11,7 @@ pythonfile Intel::FILE_NAME source1 test entry http://some-data-distributor.com/
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/seen/smtp.zeek
View file

@ -16,7 +16,7 @@ name-addr@example.com Intel::EMAIL source1 test entry http://some-data-distribut
redef Intel::read_files += { "intel.dat" };
event bro_init()
event zeek_init()
{
suspend_processing();
}

2
testing/btest/scripts/policy/frameworks/intel/whitelisting.zeek
View file

@ -23,7 +23,7 @@ redef Intel::read_files += {
global total_files_read = 0;
event bro_init()
event zeek_init()
{
suspend_processing();
}