mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 21:18:20 +00:00
Copy docs into Zeek repo directly
This is based on commit 99e6942efec5feff50523f6b2a1f5868f19ab638 from the zeek-docs repo.
This commit is contained in:
parent
979a98c73c
commit
adce4e604a
1075 changed files with 169492 additions and 1 deletions
35
doc/frameworks/sqlite-read-table.zeek
Normal file
35
doc/frameworks/sqlite-read-table.zeek
Normal file
|
@ -0,0 +1,35 @@
|
|||
type Idx: record {
|
||||
host: addr;
|
||||
};
|
||||
|
||||
type Val: record {
|
||||
users: set[string];
|
||||
};
|
||||
|
||||
global hostslist: table[addr] of Val = table();
|
||||
|
||||
event zeek_init()
|
||||
{
|
||||
Input::add_table([$source="/var/db/hosts",
|
||||
$name="hosts",
|
||||
$idx=Idx,
|
||||
$val=Val,
|
||||
$destination=hostslist,
|
||||
$reader=Input::READER_SQLITE,
|
||||
$config=table(["query"] = "select * from machines_to_users;")
|
||||
]);
|
||||
|
||||
Input::remove("hosts");
|
||||
}
|
||||
|
||||
event Input::end_of_data(name: string, source: string)
|
||||
{
|
||||
if ( name != "hosts" )
|
||||
return;
|
||||
|
||||
# now all data is in the table
|
||||
print "Hosts list has been successfully imported";
|
||||
|
||||
# List the users of one host.
|
||||
print hostslist[192.168.17.1]$users;
|
||||
}
|
Loading…
Add table
Add a link
Reference in a new issue