mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 11:08:20 +00:00
Minor grammar edits to Installation and Quick Start pages
This commit is contained in:
parent
392d1cb759
commit
af95026348
2 changed files with 10 additions and 10 deletions
|
@ -89,7 +89,7 @@ Optional Dependencies
|
||||||
Bro can make use of some optional libraries and tools if they are found at
|
Bro can make use of some optional libraries and tools if they are found at
|
||||||
build time:
|
build time:
|
||||||
|
|
||||||
* LibGeoIP (for geo-locating IP addresses)
|
* LibGeoIP (for geolocating IP addresses)
|
||||||
* sendmail (enables Bro and BroControl to send mail)
|
* sendmail (enables Bro and BroControl to send mail)
|
||||||
* gawk (enables all features of bro-cut)
|
* gawk (enables all features of bro-cut)
|
||||||
* curl (used by a Bro script that implements active HTTP)
|
* curl (used by a Bro script that implements active HTTP)
|
||||||
|
@ -137,11 +137,11 @@ The primary install prefix for binary packages is ``/opt/bro``.
|
||||||
Non-MacOS packages that include BroControl also put variable/runtime
|
Non-MacOS packages that include BroControl also put variable/runtime
|
||||||
data (e.g. Bro logs) in ``/var/opt/bro``.
|
data (e.g. Bro logs) in ``/var/opt/bro``.
|
||||||
|
|
||||||
Installing From Source
|
Installing from Source
|
||||||
==========================
|
==========================
|
||||||
|
|
||||||
Bro releases are bundled into source packages for convenience and
|
Bro releases are bundled into source packages for convenience and are
|
||||||
available from the `bro downloads page`_. Alternatively, the latest
|
available on the `bro downloads page`_. Alternatively, the latest
|
||||||
Bro development version can be obtained through git repositories
|
Bro development version can be obtained through git repositories
|
||||||
hosted at ``git.bro.org``. See our `git development documentation
|
hosted at ``git.bro.org``. See our `git development documentation
|
||||||
<http://bro.org/development/process.html>`_ for comprehensive
|
<http://bro.org/development/process.html>`_ for comprehensive
|
||||||
|
|
|
@ -155,7 +155,7 @@ changes we want to make:
|
||||||
attempt looks like it may have been successful, and we want email when
|
attempt looks like it may have been successful, and we want email when
|
||||||
that happens, but only for certain servers.
|
that happens, but only for certain servers.
|
||||||
|
|
||||||
So we've defined *what* we want to do, but need to know *where* to do it.
|
We've defined *what* we want to do, but need to know *where* to do it.
|
||||||
The answer is to use a script written in the Bro programming language, so
|
The answer is to use a script written in the Bro programming language, so
|
||||||
let's do a quick intro to Bro scripting.
|
let's do a quick intro to Bro scripting.
|
||||||
|
|
||||||
|
@ -181,7 +181,7 @@ must explicitly choose if they want to load them.
|
||||||
|
|
||||||
The main entry point for the default analysis configuration of a standalone
|
The main entry point for the default analysis configuration of a standalone
|
||||||
Bro instance managed by BroControl is the ``$PREFIX/share/bro/site/local.bro``
|
Bro instance managed by BroControl is the ``$PREFIX/share/bro/site/local.bro``
|
||||||
script. So we'll be adding to that in the following sections, but first
|
script. We'll be adding to that in the following sections, but first
|
||||||
we have to figure out what to add.
|
we have to figure out what to add.
|
||||||
|
|
||||||
Redefining Script Option Variables
|
Redefining Script Option Variables
|
||||||
|
@ -197,7 +197,7 @@ A redefineable constant might seem strange, but what that really means is that
|
||||||
the variable's value may not change at run-time, but whose initial value can be
|
the variable's value may not change at run-time, but whose initial value can be
|
||||||
modified via the ``redef`` operator at parse-time.
|
modified via the ``redef`` operator at parse-time.
|
||||||
|
|
||||||
So let's continue on our path to modify the behavior for the two SSL
|
Let's continue on our path to modify the behavior for the two SSL
|
||||||
and SSH notices. Looking at :doc:`/scripts/base/frameworks/notice/main.bro`,
|
and SSH notices. Looking at :doc:`/scripts/base/frameworks/notice/main.bro`,
|
||||||
we see that it advertises:
|
we see that it advertises:
|
||||||
|
|
||||||
|
@ -211,7 +211,7 @@ we see that it advertises:
|
||||||
const ignored_types: set[Notice::Type] = {} &redef;
|
const ignored_types: set[Notice::Type] = {} &redef;
|
||||||
}
|
}
|
||||||
|
|
||||||
That's exactly what we want to do for the SSL notice. So add to ``local.bro``:
|
That's exactly what we want to do for the SSL notice. Add to ``local.bro``:
|
||||||
|
|
||||||
.. code:: bro
|
.. code:: bro
|
||||||
|
|
||||||
|
@ -276,9 +276,9 @@ an email on the condition that the predicate function evaluates to true, which
|
||||||
is whenever the notice type is an SSH login and the responding host stored
|
is whenever the notice type is an SSH login and the responding host stored
|
||||||
inside the ``Info`` record's connection field is in the set of watched servers.
|
inside the ``Info`` record's connection field is in the set of watched servers.
|
||||||
|
|
||||||
.. note:: record field member access is done with the '$' character
|
.. note:: Record field member access is done with the '$' character
|
||||||
instead of a '.' as might be expected from other languages, in
|
instead of a '.' as might be expected from other languages, in
|
||||||
order to avoid ambiguity with the builtin address type's use of '.'
|
order to avoid ambiguity with the built-in address type's use of '.'
|
||||||
in IPv4 dotted decimal representations.
|
in IPv4 dotted decimal representations.
|
||||||
|
|
||||||
Remember, to finalize that configuration change perform the ``check``,
|
Remember, to finalize that configuration change perform the ``check``,
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue