diff --git a/CHANGES b/CHANGES index a72768373e..1a39872cee 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,10 @@ +3.1.0-dev.5 | 2019-08-09 09:33:22 -0700 + + * Add Intel::read_error event to allow custom error handling (Mauro Palumbo) + + * Export Intel::read_entry event for general user access (Mauro Palumbo) + 3.1.0-dev | 2019-08-08 16:08:50 -0700 * Change version to 3.1.0-dev (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 0f9d6b15dc..8edae5f781 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.1.0-dev +3.1.0-dev.5 diff --git a/doc b/doc index 0ac09d8417..1cd9867ca6 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit 0ac09d8417a2065aa0b59a5de3ae9ffde08f4b4a +Subproject commit 1cd9867ca6c8ab73db1f2b665ec69332fe88734c diff --git a/scripts/base/frameworks/intel/input.zeek b/scripts/base/frameworks/intel/input.zeek index 4dfa011fad..84c85313b5 100644 --- a/scripts/base/frameworks/intel/input.zeek +++ b/scripts/base/frameworks/intel/input.zeek @@ -20,6 +20,30 @@ export { ## any path_prefix specified in the input framework will apply ## additionally. const path_prefix = "" &redef; + + ## This event is raised each time the intel framework reads a new line + ## from an intel file. It is used in the intel framework but can + ## also be used in custom scripts for further checks. + ## + ## desc: The :zeek:type:`Input::EventDescription` record which generated the event. + ## + ## tpe: The type of input event. + ## + ## item: The intel item being read (of type :zeek:type:`Intel::Item`). + ## + global read_entry: event(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item); + + ## This event is raised each time the input framework detects an error + ## while reading the intel file. It can be used to implement further checks + ## in custom scripts. Errors can be of different levels (information, warning, errors). + ## + ## desc: The :zeek:type:`Input::EventDescription` record which generated the error. + ## + ## message: An error message. + ## + ## level: The :zeek:type:`Reporter::Level` of the error. + ## + global read_error: event(desc: Input::EventDescription, message: string, level: Reporter::Level); } event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item) @@ -49,7 +73,8 @@ event zeek_init() &priority=5 $mode=Input::REREAD, $name=cat("intel-", a_file), $fields=Intel::Item, - $ev=Intel::read_entry]); + $ev=Intel::read_entry, + $error_ev=Intel::read_error]); } } }