Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'export_intel_events' of https://github.com/mauropalumbo75/zeek

Browse source 
* 'export_intel_events' of https://github.com/mauropalumbo75/zeek:
  minor restyle and add comments
  add an empty read_error event to the intel framework (in the export block, so that users can implement further checks with it)
  move event Intel::read_entry to export block

Adjusted whitespace in merge.
This commit is contained in:
Jon Siwek 2019-08-09 09:33:22 -07:00
commit acd1be6e7b
4 changed files with 34 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

27
scripts/base/frameworks/intel/input.zeek
View file

@ -20,6 +20,30 @@ export {
## any path_prefix specified in the input framework will apply
## additionally.
const path_prefix = "" &redef;
## This event is raised each time the intel framework reads a new line
## from an intel file. It is used in the intel framework but can
## also be used in custom scripts for further checks.
##
## desc: The :zeek:type:`Input::EventDescription` record which generated the event.
##
## tpe: The type of input event.
##
## item: The intel item being read (of type :zeek:type:`Intel::Item`).
##
global read_entry: event(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item);
## This event is raised each time the input framework detects an error
## while reading the intel file. It can be used to implement further checks
## in custom scripts. Errors can be of different levels (information, warning, errors).
##
## desc: The :zeek:type:`Input::EventDescription` record which generated the error.
##
## message: An error message.
##
## level: The :zeek:type:`Reporter::Level` of the error.
##
global read_error: event(desc: Input::EventDescription, message: string, level: Reporter::Level);
}
event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item)
@ -49,7 +73,8 @@ event zeek_init() &priority=5
$mode=Input::REREAD,
$name=cat("intel-", a_file),
$fields=Intel::Item,
$ev=Intel::read_entry]);
$ev=Intel::read_entry,
$error_ev=Intel::read_error]);
}
}
}