mirror of
https://github.com/zeek/zeek.git
synced 2025-10-17 14:08:20 +00:00
Weird settings: make constants into options.
The new weird settings are now all updateable during runtime.
This commit is contained in:
Johanna Amann
parent
5c68093bc3
commit
bec98b98f3
9 changed files with 675 additions and 12 deletions
|
|
@ -0,0 +1,13 @@
|
|||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path config
|
||||
#open 2018-09-05-19-30-42
|
||||
#fields ts id old_value new_value location
|
||||
#types time string string string string
|
||||
0.000000 Weird::sampling_duration 10.0 mins 5.0 secs -
|
||||
0.000000 Weird::sampling_threshold 25 10 -
|
||||
0.000000 Weird::sampling_rate 1000 10 -
|
||||
0.000000 Weird::sampling_whitelist (empty) whitelisted_net_weird,whitelisted_flow_weird,whitelisted_conn_weird -
|
||||
#close 2018-09-05-19-30-42
|
||||
|
|
@ -0,0 +1,360 @@
|
|||
Config values set
|
||||
{
|
||||
whitelisted_net_weird,
|
||||
whitelisted_flow_weird,
|
||||
whitelisted_conn_weird
|
||||
}
|
||||
10
|
||||
10
|
||||
5.0
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
net_weird, my_net_weird
|
||||
flow_weird, my_flow_weird
|
||||
conn_weird, my_conn_weird
|
||||
net_weird, whitelisted_net_weird
|
||||
flow_weird, whitelisted_flow_weird
|
||||
conn_weird, whitelisted_conn_weird
|
||||
66
testing/btest/scripts/base/frameworks/config/weird.bro
Normal file
66
testing/btest/scripts/base/frameworks/config/weird.bro
Normal file
|
|
@ -0,0 +1,66 @@
|
|||
# @TEST-EXEC: bro -r $TRACES/http/bro.org.pcap %INPUT >output
|
||||
# @TEST-EXEC: btest-diff output
|
||||
# @TEST-EXEC: btest-diff config.log
|
||||
|
||||
event bro_init()
|
||||
{
|
||||
Config::set_value("Weird::sampling_duration", 5sec);
|
||||
Config::set_value("Weird::sampling_threshold", 10);
|
||||
Config::set_value("Weird::sampling_rate", 10);
|
||||
Config::set_value("Weird::sampling_whitelist", set("whitelisted_net_weird", "whitelisted_flow_weird", "whitelisted_conn_weird"));
|
||||
print "Config values set";
|
||||
}
|
||||
|
||||
event bro_init() &priority = -10
|
||||
{
|
||||
print Reporter::get_weird_sampling_whitelist();
|
||||
print Reporter::get_weird_sampling_rate();
|
||||
print Reporter::get_weird_sampling_threshold();
|
||||
print Reporter::get_weird_sampling_duration();
|
||||
}
|
||||
|
||||
event conn_weird(name: string, c: connection, addl: string)
|
||||
{
|
||||
print "conn_weird", name;
|
||||
}
|
||||
|
||||
event flow_weird(name: string, src: addr, dst: addr)
|
||||
{
|
||||
print "flow_weird", name;
|
||||
}
|
||||
|
||||
event net_weird(name: string)
|
||||
{
|
||||
print "net_weird", name;
|
||||
}
|
||||
|
||||
event gen_weirds(c: connection)
|
||||
{
|
||||
local num = 30;
|
||||
|
||||
while ( num != 0 )
|
||||
{
|
||||
Reporter::net_weird("my_net_weird");
|
||||
Reporter::flow_weird("my_flow_weird", c$id$orig_h, c$id$resp_h);
|
||||
Reporter::conn_weird("my_conn_weird", c);
|
||||
|
||||
Reporter::net_weird("whitelisted_net_weird");
|
||||
Reporter::flow_weird("whitelisted_flow_weird", c$id$orig_h, c$id$resp_h);
|
||||
Reporter::conn_weird("whitelisted_conn_weird", c);
|
||||
--num;
|
||||
}
|
||||
}
|
||||
|
||||
global did_one_connection = F;
|
||||
|
||||
event new_connection(c: connection)
|
||||
{
|
||||
if ( did_one_connection )
|
||||
return;
|
||||
|
||||
did_one_connection = T;
|
||||
event gen_weirds(c); # should permit 10 + 2 of each "my" weird
|
||||
schedule 2sec { gen_weirds(c) }; # should permit 3 of each "my" weird
|
||||
schedule 7sec { gen_weirds(c) }; # should permit 10 + 2 of each "my" weird
|
||||
# Total of 27 "my" weirds of each type and 90 of each "whitelisted" type
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue