Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Added sources to the intel log.

Browse source
This commit is contained in:
Seth Hall 2012-09-28 21:17:14 -04:00
parent 03532ff051
commit bacc99f645
1 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/base/frameworks/intel/main.bro
View file

@ -73,12 +73,13 @@ export {
};
type Info: record {
ts: time &log;
ts: time &log;
uid: string &log &optional;
id: conn_id &log &optional;
uid: string &log &optional;
id: conn_id &log &optional;
seen: Seen &log;
seen: Seen &log;
sources: set[string] &log;
};
type PolicyItem: record {
@ -233,7 +234,8 @@ function has_meta(check: MetaData, metas: set[MetaData]): bool
event Intel::match(s: Seen, items: set[Item])
{
local info: Info = [$ts=network_time(), $seen=s];
local empty_set: set[string] = set();
local info: Info = [$ts=network_time(), $seen=s, $sources=empty_set];
if ( s?$conn )
{
@ -241,6 +243,9 @@ event Intel::match(s: Seen, items: set[Item])
info$id = s$conn$id;
}
for ( item in items )
add info$sources[item$meta$source];
Log::write(Intel::LOG, info);
}