Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'topic/jgras/intel-update' of https://github.com/J-Gras/bro into topic/seth/intel-update-merge

Browse source 
# Conflicts:
#	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
#	testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log
This commit is contained in:
Seth Hall 2016-08-02 15:50:43 -04:00
commit d6a7322a75
27 changed files with 905 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/policy/frameworks/intel/seen/certs.bro
View file

@ -1,4 +1,4 @@
# @TEST-EXEC: bro -r $TRACES/tls/ecdsa-cert.pcap %INPUT
# @TEST-EXEC: bro -Cr $TRACES/tls/ecdsa-cert.pcap %INPUT
# @TEST-EXEC: cat intel.log > intel-all.log
# @TEST-EXEC: bro -r $TRACES/tls/ssl.v3.trace %INPUT
# @TEST-EXEC: cat intel.log >> intel-all.log

39
testing/btest/scripts/policy/frameworks/intel/whitelisting.bro Normal file
View file

@ -0,0 +1,39 @@
# @TEST-EXEC: bro -Cr $TRACES/wikipedia.trace %INPUT
# @TEST-EXEC: btest-diff intel.log
#@TEST-START-FILE intel.dat
#fields indicator indicator_type meta.source meta.desc meta.url
upload.wikimedia.org Intel::DOMAIN source1 somehow bad http://some-data-distributor.com/1
meta.wikimedia.org Intel::DOMAIN source1 also bad http://some-data-distributor.com/1
#@TEST-END-FILE
#@TEST-START-FILE whitelist.dat
#fields indicator indicator_type meta.source meta.desc meta.whitelist meta.url
meta.wikimedia.org Intel::DOMAIN source2 also bad T http://some-data-distributor.com/1
#@TEST-END-FILE
@load base/frameworks/intel
@load frameworks/intel/whitelist
@load frameworks/intel/seen
redef Intel::read_files += {
"intel.dat",
"whitelist.dat",
};
global total_files_read = 0;
event bro_init()
{
suspend_processing();
}
event Input::end_of_data(name: string, source: string)
{
# Wait until both intel files are read.
if ( /^intel-/ in name && (++total_files_read == 2) )
{
continue_processing();
}
}