Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Separated file and default info added to matches.

Browse source
This commit is contained in:
Jan Grashoefer 2016-09-20 02:04:15 +02:00
parent 46aafdc87b
commit cb53a930a2
2 changed files with 20 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/frameworks/intel/files.bro
View file

@ -45,7 +45,7 @@ export {
}
# Add file information to matches if available.
hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5
hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=6
{
if ( s?$f )
{
@ -66,19 +66,4 @@ hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5
if ( s?$fuid )
info$fuid = s$fuid;
if ( s?$conn )
{
s$uid = s$conn$uid;
info$id = s$conn$id;
}
if ( s?$uid )
info$uid = s$uid;
for ( item in items )
{
add info$sources[item$meta$source];
add info$matched[item$indicator_type];
}
}

19
scripts/base/frameworks/intel/main.bro
View file

@ -369,6 +369,25 @@ event Intel::match(s: Seen, items: set[Item]) &priority=5
Log::write(Intel::LOG, info);
}
hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5
{
# Add default information to matches.
if ( s?$conn )
{
s$uid = s$conn$uid;
info$id = s$conn$id;
}
if ( s?$uid )
info$uid = s$uid;
for ( item in items )
{
add info$sources[item$meta$source];
add info$matched[item$indicator_type];
}
}
function insert(item: Item)
{
# Create and fill out the metadata item.