Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix typos and formatting in the signature framework docs

Browse source
This commit is contained in:
Daniel Thayer 2013-10-22 09:37:43 -05:00
parent 5a0e3dda7e
commit f5d6931f00
1 changed files with 30 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

56
scripts/base/frameworks/signatures/main.bro
View file

@ -11,21 +11,23 @@ export {
redef enum Notice::Type += { redef enum Notice::Type += {
## Generic notice type for notice-worthy signature matches. ## Generic notice type for notice-worthy signature matches.
Sensitive_Signature, Sensitive_Signature,
## Host has triggered many signatures on the same host. The number of ## Host has triggered many signatures on the same host. The
## signatures is defined by the ## number of signatures is defined by the
## :bro:id:`Signatures::vert_scan_thresholds` variable. ## :bro:id:`Signatures::vert_scan_thresholds` variable.
Multiple_Signatures, Multiple_Signatures,
## Host has triggered the same signature on multiple hosts as defined ## Host has triggered the same signature on multiple hosts as
## by the :bro:id:`Signatures::horiz_scan_thresholds` variable. ## defined by the :bro:id:`Signatures::horiz_scan_thresholds`
## variable.
Multiple_Sig_Responders, Multiple_Sig_Responders,
## The same signature has triggered multiple times for a host. The ## The same signature has triggered multiple times for a host.
## number of times the signature has been triggered is defined by the ## The number of times the signature has been triggered is
## :bro:id:`Signatures::count_thresholds` variable. To generate this ## defined by the :bro:id:`Signatures::count_thresholds`
## notice, the :bro:enum:`Signatures::SIG_COUNT_PER_RESP` action must ## variable. To generate this notice, the
## bet set for the signature. ## :bro:enum:`Signatures::SIG_COUNT_PER_RESP` action must be
## set for the signature.
Count_Signature, Count_Signature,
## Summarize the number of times a host triggered a signature. The ## Summarize the number of times a host triggered a signature.
## interval between summaries is defined by the ## The interval between summaries is defined by the
## :bro:id:`Signatures::summary_interval` variable. ## :bro:id:`Signatures::summary_interval` variable.
Signature_Summary, Signature_Summary,
}; };
@ -37,11 +39,12 @@ export {
## All of them write the signature record to the logging stream unless ## All of them write the signature record to the logging stream unless
## declared otherwise. ## declared otherwise.
type Action: enum { type Action: enum {
## Ignore this signature completely (even for scan detection). Don't ## Ignore this signature completely (even for scan detection).
## write to the signatures logging stream. ## Don't write to the signatures logging stream.
SIG_IGNORE, SIG_IGNORE,
## Process through the various aggregate techniques, but don't report ## Process through the various aggregate techniques, but don't
## individually and don't write to the signatures logging stream. ## report individually and don't write to the signatures logging
## stream.
SIG_QUIET, SIG_QUIET,
## Generate a notice. ## Generate a notice.
SIG_LOG, SIG_LOG,
@ -64,20 +67,21 @@ export {
## The record type which contains the column fields of the signature log. ## The record type which contains the column fields of the signature log.
type Info: record { type Info: record {
## The network time at which a signature matching type of event to ## The network time at which a signature matching type of event
## be logged has occurred. ## to be logged has occurred.
ts: time &log; ts: time &log;
## The host which triggered the signature match event. ## The host which triggered the signature match event.
src_addr: addr &log &optional; src_addr: addr &log &optional;
## The host port on which the signature-matching activity occurred. ## The host port on which the signature-matching activity
## occurred.
src_port: port &log &optional; src_port: port &log &optional;
## The destination host which was sent the payload that triggered the ## The destination host which was sent the payload that
## signature match. ## triggered the signature match.
dst_addr: addr &log &optional; dst_addr: addr &log &optional;
## The destination host port which was sent the payload that triggered ## The destination host port which was sent the payload that
## the signature match. ## triggered the signature match.
dst_port: port &log &optional; dst_port: port &log &optional;
## Notice associated with signature event ## Notice associated with signature event.
note: Notice::Type &log; note: Notice::Type &log;
## The name of the signature that matched. ## The name of the signature that matched.
sig_id: string &log &optional; sig_id: string &log &optional;
@ -103,8 +107,8 @@ export {
## different responders has reached one of the thresholds. ## different responders has reached one of the thresholds.
const horiz_scan_thresholds = { 5, 10, 50, 100, 500, 1000 } &redef; const horiz_scan_thresholds = { 5, 10, 50, 100, 500, 1000 } &redef;
## Generate a notice if, for a pair [orig, resp], the number of different ## Generate a notice if, for a pair [orig, resp], the number of
## signature matches has reached one of the thresholds. ## different signature matches has reached one of the thresholds.
const vert_scan_thresholds = { 5, 10, 50, 100, 500, 1000 } &redef; const vert_scan_thresholds = { 5, 10, 50, 100, 500, 1000 } &redef;
## Generate a notice if a :bro:enum:`Signatures::SIG_COUNT_PER_RESP` ## Generate a notice if a :bro:enum:`Signatures::SIG_COUNT_PER_RESP`
@ -112,7 +116,7 @@ export {
const count_thresholds = { 5, 10, 50, 100, 500, 1000, 10000, 1000000, } &redef; const count_thresholds = { 5, 10, 50, 100, 500, 1000, 10000, 1000000, } &redef;
## The interval between when :bro:enum:`Signatures::Signature_Summary` ## The interval between when :bro:enum:`Signatures::Signature_Summary`
## notice are generated. ## notices are generated.
const summary_interval = 1 day &redef; const summary_interval = 1 day &redef;
## This event can be handled to access/alter data about to be logged ## This event can be handled to access/alter data about to be logged