mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
Fix broken/missing documentation.
This commit is contained in:
parent
e46300a724
commit
e45933562e
13 changed files with 71 additions and 46 deletions
|
@ -195,7 +195,7 @@ export {
|
|||
##
|
||||
## Returns: True if a new stream was successfully removed.
|
||||
##
|
||||
## .. bro:see:: Log:create_stream
|
||||
## .. bro:see:: Log::create_stream
|
||||
global remove_stream: function(id: ID) : bool;
|
||||
|
||||
## Enables a previously disabled logging stream. Disabled streams
|
||||
|
|
|
@ -431,9 +431,6 @@ hook Notice::notice(n: Notice::Info) &priority=-5
|
|||
}
|
||||
}
|
||||
|
||||
## This determines if a notice is being suppressed. It is only used
|
||||
## internally as part of the mechanics for the global :bro:id:`NOTICE`
|
||||
## function.
|
||||
function is_being_suppressed(n: Notice::Info): bool
|
||||
{
|
||||
if ( n?$identifier && [n$note, n$identifier] in suppressing )
|
||||
|
|
|
@ -99,7 +99,7 @@ export {
|
|||
reducers: set[Reducer];
|
||||
|
||||
## Provide a function to calculate a value from the
|
||||
## :bro:see:`Result` structure which will be used
|
||||
## :bro:see:`SumStats::Result` structure which will be used
|
||||
## for thresholding.
|
||||
## This is required if a $threshold value is given.
|
||||
threshold_val: function(key: SumStats::Key, result: SumStats::Result): count &optional;
|
||||
|
|
|
@ -16,7 +16,8 @@ export {
|
|||
|
||||
redef record ResultVal += {
|
||||
## This is the queue where elements are maintained. Use the
|
||||
## :bro:see:`SumStats::get_elements` function to get a vector of the current element values.
|
||||
## :bro:see:`SumStats::get_last` function to get a vector of
|
||||
## the current element values.
|
||||
last_elements: Queue::Queue &optional;
|
||||
};
|
||||
|
||||
|
|
|
@ -101,20 +101,21 @@ export {
|
|||
##
|
||||
## is_query: Indicator for if this is being called for a query or a response.
|
||||
global set_session: hook(c: connection, msg: dns_msg, is_query: bool);
|
||||
|
||||
## A record type which tracks the status of DNS queries for a given
|
||||
## :bro:type:`connection`.
|
||||
type State: record {
|
||||
## Indexed by query id, returns Info record corresponding to
|
||||
## query/response which haven't completed yet.
|
||||
pending: table[count] of Queue::Queue;
|
||||
|
||||
## This is the list of DNS responses that have completed based on the
|
||||
## number of responses declared and the number received. The contents
|
||||
## of the set are transaction IDs.
|
||||
finished_answers: set[count];
|
||||
};
|
||||
}
|
||||
|
||||
## A record type which tracks the status of DNS queries for a given
|
||||
## :bro:type:`connection`.
|
||||
type State: record {
|
||||
## Indexed by query id, returns Info record corresponding to
|
||||
## query/response which haven't completed yet.
|
||||
pending: table[count] of Queue::Queue;
|
||||
|
||||
## This is the list of DNS responses that have completed based on the
|
||||
## number of responses declared and the number received. The contents
|
||||
## of the set are transaction IDs.
|
||||
finished_answers: set[count];
|
||||
};
|
||||
|
||||
redef record connection += {
|
||||
dns: Info &optional;
|
||||
|
|
|
@ -16,7 +16,7 @@ export {
|
|||
|
||||
## Initialize a queue record structure.
|
||||
##
|
||||
## s: A :bro:record:`Settings` record configuring the queue.
|
||||
## s: A record which configures the queue.
|
||||
##
|
||||
## Returns: An opaque queue record.
|
||||
global init: function(s: Settings &default=[]): Queue;
|
||||
|
|
|
@ -32,8 +32,8 @@ export {
|
|||
const icmp_time_exceeded_threshold = 3 &redef;
|
||||
|
||||
## Interval at which to watch for the
|
||||
## :bro:id:`ICMPTimeExceeded::icmp_time_exceeded_threshold` variable to be crossed.
|
||||
## At the end of each interval the counter is reset.
|
||||
## :bro:id:`Traceroute::icmp_time_exceeded_threshold` variable to be
|
||||
## crossed. At the end of each interval the counter is reset.
|
||||
const icmp_time_exceeded_interval = 3min &redef;
|
||||
|
||||
## The log record for the traceroute log.
|
||||
|
|
|
@ -13,17 +13,18 @@ module Scan;
|
|||
|
||||
export {
|
||||
redef enum Notice::Type += {
|
||||
## Address scans detect that a host appears to be scanning some number of
|
||||
## destinations on a single port. This notice is generated when more than
|
||||
## :bro:id:`addr_scan_threshold` unique hosts are seen over the previous
|
||||
## :bro:id:`addr_scan_interval` time range.
|
||||
## Address scans detect that a host appears to be scanning some number
|
||||
## of destinations on a single port. This notice is generated when more
|
||||
## than :bro:id:`Scan::addr_scan_threshold` unique hosts are seen over
|
||||
## the previous :bro:id:`Scan::addr_scan_interval` time range.
|
||||
Address_Scan,
|
||||
|
||||
## Port scans detect that an attacking host appears to be scanning a
|
||||
## single victim host on several ports. This notice is generated when
|
||||
## an attacking host attempts to connect to :bro:id:`port_scan_threshold`
|
||||
## an attacking host attempts to connect to
|
||||
## :bro:id:`Scan::port_scan_threshold`
|
||||
## unique ports on a single host over the previous
|
||||
## :bro:id:`port_scan_interval` time range.
|
||||
## :bro:id:`Scan::port_scan_interval` time range.
|
||||
Port_Scan,
|
||||
};
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue