Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Renamed HTTP::build_url function to HTTP::build_url_http

Browse source 
- HTTP::build_url no longer prepends http:// to the url.
This commit is contained in:
Seth Hall 2011-06-17 23:26:54 -04:00
parent 291920b013
commit e17193ff3e
5 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
policy/detectors/http-MHR.bro
View file

@ -18,14 +18,13 @@ event log_http(rec: HTTP::Info)
{
if ( rec?$md5 )
{
local url = HTTP::build_url(rec);
local hash_domain = fmt("%s.malware.hash.cymru.com", rec$md5);
when ( local addrs = lookup_hostname(hash_domain) )
{
# 127.0.0.2 indicates that the md5 sum was found in the MHR.
if ( 127.0.0.2 in addrs )
{
local url = HTTP::build_url_http(rec);
local message = fmt("%s %s %s", rec$id$orig_h, rec$md5, url);
NOTICE([$note=Malware_Hash_Registry_Match,
$msg=message, $id=rec$id, $URL=url]);