Merge remote-tracking branch 'origin/topic/jsiwek/reorg-followup'

scripts/policy/protocols/conn/known-hosts.bro

@@ -3,6 +3,8 @@
 ##! output provides an easy way to determine a count of the IP addresses in
 ##! use on a network per day.
 
+@load base/utils/directions-and-hosts
+
 module KnownHosts;
 
 export {

scripts/policy/protocols/conn/known-services.bro

@@ -3,6 +3,8 @@
 ##! completed a TCP handshake with another host.  If a protocol is detected
 ##! during the session, the protocol will also be logged.
 
+@load base/utils/directions-and-hosts
+
 module KnownServices;
 
 redef enum Log::ID += { KNOWN_SERVICES };

scripts/policy/protocols/conn/scan.bro

@@ -1,4 +1,4 @@
-@load base/frameworks/notice
+@load base/frameworks/notice/main
 @load port-name
 
 module Scan;

scripts/policy/protocols/dns/auth-addl.bro

@@ -1,3 +1,4 @@
+@load base/protocols/dns/main
 
 redef dns_skip_all_auth = F;
 redef dns_skip_all_addl = F;

scripts/policy/protocols/dns/detect-external-names.bro

@@ -8,6 +8,9 @@
 ##!     to be within a local zone.  :bro:id:`local_zones` variable **must**
 ##!     be set appropriately for this detection.
 
+@load base/frameworks/notice/main
+@load base/utils/site
+
 module DNS;
 
 export {

scripts/policy/protocols/ftp/detect.bro

@@ -1,3 +1,5 @@
+@load base/frameworks/notice/main
+@load base/protocols/ftp/main
 
 module FTP;
 
@@ -21,4 +23,4 @@ event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool) &prior
 		NOTICE([$note=Site_Exec_Success, $conn=c,
 		        $msg=fmt("%s %s", c$ftp$cmdarg$cmd, c$ftp$cmdarg$arg)]);
 		}
-	}
+	}

scripts/policy/protocols/ftp/software.bro

@@ -6,6 +6,8 @@
 ##! * Detect client software with password given for anonymous users
 ##!   (e.g. cyberduck@example.net)
 
+@load base/frameworks/software/main
+
 module FTP;
 
 export {

scripts/policy/protocols/http/detect-MHR.bro

@@ -4,6 +4,11 @@
 ##! documentation for the :doc:base/protocols/http/file-hash.bro script to see how to 
 ##! configure which transfers will have hashes calculated.
 
+@load base/frameworks/notice/main
+@load base/protocols/http/main
+@load base/protocols/http/utils
+@load base/protocols/http/file-hash
+
 export {
 	redef enum Notice::Type += { 
 		## If the MD5 sum of a file transferred over HTTP 

scripts/policy/protocols/http/detect-intel.bro

@@ -1,5 +1,9 @@
 ##! Intelligence based HTTP detections.
 
+@load base/protocols/http/main
+@load base/protocols/http/utils
+@load base/frameworks/intel/main
+
 module HTTP;
 
 event log_http(rec: Info)
@@ -14,4 +18,4 @@ event log_http(rec: Info)
 		        $sub=HTTP::build_url_http(rec), 
 		        $id=rec$id]);
 		}
-	}
+	}

scripts/policy/protocols/http/detect-sqli.bro

@@ -1,5 +1,9 @@
 ##! SQL injection detection in HTTP.
 
+@load base/frameworks/notice/main
+@load base/frameworks/metrics/main
+@load base/protocols/http/main
+
 module HTTP;
 
 export {
@@ -54,4 +58,4 @@ event http_request(c: connection, method: string, original_URI: string,
 		Metrics::add_data(SQL_ATTACKS, [$host=c$id$orig_h], 1);
 		Metrics::add_data(SQL_ATTACKS_AGAINST, [$host=c$id$resp_h], 1);
 		}
-	}
+	}

scripts/policy/protocols/http/detect-webapps.bro

@@ -1,3 +1,7 @@
+@load base/frameworks/signatures/main
+@load base/frameworks/software/main
+@load base/protocols/http/main
+@load base/protocols/http/utils
 
 module HTTP;
 

scripts/policy/protocols/http/headers.bro

@@ -1,5 +1,7 @@
 ##! Extract and include the header keys used for each request in the log.
 
+@load base/protocols/http/main
+
 module HTTP;
 
 export {

scripts/policy/protocols/http/software.bro

@@ -1,5 +1,7 @@
 ##! Software identification and extraction for HTTP traffic.
 
+@load base/frameworks/software/main
+
 module HTTP;
 
 export {
@@ -52,4 +54,4 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
 			Software::found(c$id, Software::parse(value, c$id$resp_h, WEB_APPSERVER));
 			}
 		}
-	}
+	}

scripts/policy/protocols/http/var-extraction-cookies.bro

@@ -1,5 +1,8 @@
 ##! This script extracts and logs variables from cookies sent by clients
 
+@load base/protocols/http/main
+@load base/protocols/http/utils
+
 module HTTP;
 
 redef record Info += {

scripts/policy/protocols/http/var-extraction-uri.bro

@@ -1,5 +1,8 @@
 ##! This script extracts and logs variables from the requested URI
 
+@load base/protocols/http/main
+@load base/protocols/http/utils
+
 module HTTP;
 
 redef record Info += {

scripts/policy/protocols/smtp/detect-suspicious-orig.bro

@@ -1,3 +1,5 @@
+@load base/frameworks/notice/main
+@load base/protocols/smtp/main
 
 module SMTP;
 

scripts/policy/protocols/smtp/software.bro

@@ -7,6 +7,9 @@
 ##! * Find some heuristic to determine if email was sent through 
 ##!   a MS Exhange webmail interface as opposed to a desktop client.
 
+@load base/frameworks/software/main
+@load base/protocols/smtp/main
+
 module SMTP;
 
 export {

scripts/policy/protocols/ssh/detect-bruteforcing.bro

@@ -1,4 +1,8 @@
 
+@load base/frameworks/metrics
+@load base/frameworks/notice
+@load base/frameworks/intel
+
 module SSH;
 
 export {

scripts/policy/protocols/ssh/geo-data.bro

@@ -1,6 +1,9 @@
 ##! This implements all of the additional information and geodata detections 
 ##! for SSH analysis.
 
+@load base/frameworks/notice/main
+@load base/protocols/ssh/main
+
 module SSH;
 
 export {

scripts/policy/protocols/ssh/interesting-hostnames.bro

@@ -1,3 +1,4 @@
+@load base/frameworks/notice/main
 
 module SSH;
 

scripts/policy/protocols/ssh/software.bro

@@ -1,3 +1,4 @@
+@load base/frameworks/software/main
 
 module SSH;
 

scripts/policy/protocols/ssl/known-certs.bro

@@ -1,3 +1,4 @@
+@load base/utils/directions-and-hosts
 
 module KnownCerts;
 

scripts/policy/protocols/ssl/validate-certs.bro

@@ -1,3 +1,5 @@
+@load base/frameworks/notice/main
+@load base/protocols/ssl/main
 
 module SSL;