Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Separated file and default info added to matches.

Browse source
This commit is contained in:
Jan Grashoefer 2016-09-20 02:04:15 +02:00
parent 46aafdc87b
commit cb53a930a2
2 changed files with 20 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/base/frameworks/intel/files.bro
View file

@ -45,7 +45,7 @@ export {
} }
# Add file information to matches if available. # Add file information to matches if available.
hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5 hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=6
{ {
if ( s?$f ) if ( s?$f )
{ {
@ -66,19 +66,4 @@ hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5
if ( s?$fuid ) if ( s?$fuid )
info$fuid = s$fuid; info$fuid = s$fuid;
if ( s?$conn )
{
s$uid = s$conn$uid;
info$id = s$conn$id;
}
if ( s?$uid )
info$uid = s$uid;
for ( item in items )
{
add info$sources[item$meta$source];
add info$matched[item$indicator_type];
}
} }

19
scripts/base/frameworks/intel/main.bro
View file

@ -369,6 +369,25 @@ event Intel::match(s: Seen, items: set[Item]) &priority=5
Log::write(Intel::LOG, info); Log::write(Intel::LOG, info);
} }
hook extend_match(info: Info, s: Seen, items: set[Item]) &priority=5
{
# Add default information to matches.
if ( s?$conn )
{
s$uid = s$conn$uid;
info$id = s$conn$id;
}
if ( s?$uid )
info$uid = s$uid;
for ( item in items )
{
add info$sources[item$meta$source];
add info$matched[item$indicator_type];
}
}
function insert(item: Item) function insert(item: Item)
{ {
# Create and fill out the metadata item. # Create and fill out the metadata item.