diff --git a/scripts/base/frameworks/intel/files.bro b/scripts/base/frameworks/intel/files.bro index b786a6fefb..454f63352c 100644 --- a/scripts/base/frameworks/intel/files.bro +++ b/scripts/base/frameworks/intel/files.bro @@ -45,7 +45,7 @@ export { } # Add file information to matches if available. -hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5 +hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=6 { if ( s?$f ) { @@ -66,19 +66,4 @@ hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5 if ( s?$fuid ) info$fuid = s$fuid; - - if ( s?$conn ) - { - s$uid = s$conn$uid; - info$id = s$conn$id; - } - - if ( s?$uid ) - info$uid = s$uid; - - for ( item in items ) - { - add info$sources[item$meta$source]; - add info$matched[item$indicator_type]; - } } diff --git a/scripts/base/frameworks/intel/main.bro b/scripts/base/frameworks/intel/main.bro index 401b48e2d5..1456182fd9 100644 --- a/scripts/base/frameworks/intel/main.bro +++ b/scripts/base/frameworks/intel/main.bro @@ -369,6 +369,25 @@ event Intel::match(s: Seen, items: set[Item]) &priority=5 Log::write(Intel::LOG, info); } +hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5 + { + # Add default information to matches. + if ( s?$conn ) + { + s$uid = s$conn$uid; + info$id = s$conn$id; + } + + if ( s?$uid ) + info$uid = s$uid; + + for ( item in items ) + { + add info$sources[item$meta$source]; + add info$matched[item$indicator_type]; + } + } + function insert(item: Item) { # Create and fill out the metadata item.