Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/johanna/intel-cert-hash'

Browse source 
BIT-1567 #merged

* origin/topic/johanna/intel-cert-hash:
  Intel: CERT_HASH indicator type was never checked
This commit is contained in:
Robin Sommer 2016-04-22 08:36:24 -07:00
commit efde4a74b0
5 changed files with 24 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/policy/frameworks/intel/seen/x509.bro
View file

@ -26,3 +26,14 @@ event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certifi
$where=X509::IN_CERT]);
}
}
event file_hash(f: fa_file, kind: string, hash: string)
{
if ( ! f?$info || ! f$info?$x509 || kind != "sha1" )
return;
Intel::seen([$indicator=hash,
$indicator_type=Intel::CERT_HASH,
$f=f,
$where=X509::IN_CERT]);
}