mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 23:58:20 +00:00
Fixing documentation piece.
The interesting-hostname script has changed.
This commit is contained in:
parent
84bfd53e52
commit
d9ba7ea0dd
5 changed files with 61 additions and 26 deletions
|
@ -1116,7 +1116,7 @@ Policy, but the script attempts to supply as much information as
|
|||
possible while staying concise.
|
||||
|
||||
.. btest-include:: ${BRO_SRC_ROOT}/scripts/policy/protocols/ssh/interesting-hostnames.bro
|
||||
:lines: 1-46
|
||||
:lines: 1-52
|
||||
|
||||
While much of the script relates to the actual detection, the parts
|
||||
specific to the Notice Framework are actually quite interesting in
|
||||
|
@ -1124,8 +1124,11 @@ themselves. The script's ``export`` block adds the value
|
|||
``SSH::Interesting_Hostname_Login`` to the enumerable constant
|
||||
``Notice::Type`` to indicate to the Bro core that a new type of notice
|
||||
is being defined. The script then calls ``NOTICE`` and defines the
|
||||
``$note``, ``$msg``, ``$sub`` and ``$conn`` fields of the
|
||||
:bro:type:`Notice::Info` record. There are two ternary if
|
||||
``$note``, ``$msg``, ``$sub``, ``id``, and ``$uid`` fields of the
|
||||
:bro:type:`Notice::Info` record. (More commonly, one would set
|
||||
``$conn`` instead, however this script avoids using the connection
|
||||
record inside the when-statement for performance reasons.)
|
||||
There are two ternary if
|
||||
statements that modify the ``$msg`` text depending on whether the
|
||||
host is a local address and whether it is the client or the server.
|
||||
This use of :bro:id:`fmt` and ternary operators is a concise way to
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue