Added policy script for intel removal.

This commit is contained in:
Jan Grashoefer 2019-03-24 22:16:13 +01:00
parent 0f86aaff4b
commit c301e1c9b4

View file

@ -0,0 +1,23 @@
##! This script enables removal of intelligence items.
@load base/frameworks/intel
module Intel;
export {
redef record Intel::MetaData += {
## A boolean value to indicate whether the item should be removed.
remove: bool &default=F;
};
}
hook Intel::filter_item(item: Item)
{
if ( item$meta$remove )
{
Intel::remove(item);
# Prevent readding
break;
}
}