Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/jsiwek/reorg-followup'

Browse source
This commit is contained in:
Seth Hall 2011-08-25 16:44:31 -04:00
commit fc5f22cb5d
234 changed files with 295 additions and 104 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/policy/frameworks/control/controllee.bro
View file

@ -1,4 +1,4 @@
@load base/frameworks/control
# If an instance is a controllee, it implicitly needs to listen for remote
# connections.
@load frameworks/communication/listen-clear

1
scripts/policy/frameworks/control/controller.bro
View file

@ -1,3 +1,4 @@
@load base/frameworks/control
@load base/frameworks/communication
module Control;

4
scripts/policy/frameworks/dpd/detect-protocols.bro
View file

@ -1,5 +1,9 @@
##! Finds connections with protocols on non-standard ports with DPD.
@load base/frameworks/notice
@load base/utils/site
@load base/utils/conn-ids
module ProtocolDetector;
export {

2
scripts/policy/frameworks/dpd/packet-segment-logging.bro
View file

@ -4,6 +4,8 @@
##! A caveat to logging packet data is that in some cases, the packet may
##! not be the packet that actually caused the protocol violation.
@load base/frameworks/dpd
module DPD;
export {

4
scripts/policy/frameworks/metrics/conn-example.bro
View file

@ -1,3 +1,5 @@
@load base/frameworks/metrics
@load base/utils/site
redef enum Metrics::ID += {
CONNS_ORIGINATED,
@ -17,4 +19,4 @@ event connection_established(c: connection)
Metrics::add_data(CONNS_ORIGINATED, [$host=c$id$orig_h], 1);
Metrics::add_data(CONNS_RESPONDED, [$host=c$id$resp_h], 1);
}

9
scripts/policy/frameworks/metrics/http-example.bro
View file

@ -1,3 +1,6 @@
@load base/frameworks/metrics
@load base/protocols/http
@load base/utils/site
redef enum Metrics::ID += {
HTTP_REQUESTS_BY_STATUS_CODE,
@ -20,7 +23,7 @@ event bro_init()
event HTTP::log_http(rec: HTTP::Info)
{
if ( rec?$host )
Metrics::add_data(HTTP_REQUESTS_BY_HOST_HEADER, [$str=rec$host]);
Metrics::add_data(HTTP_REQUESTS_BY_HOST_HEADER, [$str=rec$host], 1);
if ( rec?$status_code )
Metrics::add_data(HTTP_REQUESTS_BY_STATUS_CODE, [$host=rec$id$orig_h, $str=fmt("%d", rec$status_code)]);
}
Metrics::add_data(HTTP_REQUESTS_BY_STATUS_CODE, [$host=rec$id$orig_h, $str=fmt("%d", rec$status_code)], 1);
}

5
scripts/policy/frameworks/metrics/ssl-example.bro
View file

@ -1,4 +1,5 @@
@load base/frameworks/metrics
@load base/protocols/ssl
redef enum Metrics::ID += {
SSL_SERVERNAME,
@ -19,4 +20,4 @@ event SSL::log_ssl(rec: SSL::Info)
{
if ( rec?$server_name )
Metrics::add_data(SSL_SERVERNAME, [$str=rec$server_name], 1);
}
}

2
scripts/policy/frameworks/software/version-changes.bro
View file

@ -1,3 +1,5 @@
@load base/frameworks/notice
@load base/frameworks/software
module Software;

4
scripts/policy/frameworks/software/vulnerable.bro
View file

@ -1,3 +1,5 @@
@load base/frameworks/notice
@load base/frameworks/software
module Software;
@ -18,4 +20,4 @@ event log_software(rec: Info)
{
NOTICE([$note=Vulnerable_Version, $src=rec$host, $msg=software_fmt(rec)]);
}
}
}