Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'export_intel_events' of https://github.com/mauropalumbo75/zeek

Browse source 
* 'export_intel_events' of https://github.com/mauropalumbo75/zeek:
  minor restyle and add comments
  add an empty read_error event to the intel framework (in the export block, so that users can implement further checks with it)
  move event Intel::read_entry to export block

Adjusted whitespace in merge.
This commit is contained in:
Jon Siwek 2019-08-09 09:33:22 -07:00
commit acd1be6e7b
4 changed files with 34 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,4 +1,10 @@
3.1.0-dev.5 | 2019-08-09 09:33:22 -0700
* Add Intel::read_error event to allow custom error handling (Mauro Palumbo)
* Export Intel::read_entry event for general user access (Mauro Palumbo)
3.1.0-dev | 2019-08-08 16:08:50 -0700 3.1.0-dev | 2019-08-08 16:08:50 -0700
* Change version to 3.1.0-dev (Jon Siwek, Corelight) * Change version to 3.1.0-dev (Jon Siwek, Corelight)

2
VERSION
View file

@ -1 +1 @@
3.1.0-dev 3.1.0-dev.5

2
doc

@ -1 +1 @@
Subproject commit 0ac09d8417a2065aa0b59a5de3ae9ffde08f4b4a Subproject commit 1cd9867ca6c8ab73db1f2b665ec69332fe88734c

27
scripts/base/frameworks/intel/input.zeek
View file

@ -20,6 +20,30 @@ export {
## any path_prefix specified in the input framework will apply ## any path_prefix specified in the input framework will apply
## additionally. ## additionally.
const path_prefix = "" &redef; const path_prefix = "" &redef;
## This event is raised each time the intel framework reads a new line
## from an intel file. It is used in the intel framework but can
## also be used in custom scripts for further checks.
##
## desc: The :zeek:type:`Input::EventDescription` record which generated the event.
##
## tpe: The type of input event.
##
## item: The intel item being read (of type :zeek:type:`Intel::Item`).
##
global read_entry: event(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item);
## This event is raised each time the input framework detects an error
## while reading the intel file. It can be used to implement further checks
## in custom scripts. Errors can be of different levels (information, warning, errors).
##
## desc: The :zeek:type:`Input::EventDescription` record which generated the error.
##
## message: An error message.
##
## level: The :zeek:type:`Reporter::Level` of the error.
##
global read_error: event(desc: Input::EventDescription, message: string, level: Reporter::Level);
} }
event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item) event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item)
@ -49,7 +73,8 @@ event zeek_init() &priority=5
$mode=Input::REREAD, $mode=Input::REREAD,
$name=cat("intel-", a_file), $name=cat("intel-", a_file),
$fields=Intel::Item, $fields=Intel::Item,
$ev=Intel::read_entry]); $ev=Intel::read_entry,
$error_ev=Intel::read_error]);
} }
} }
} }