Commit graph

13 commits

Author SHA1 Message Date
Arne Welzel
c687a24503 site/local: Switch to detect-sql-injection 2025-05-20 16:24:28 +02:00
Arne Welzel
bf9704f339 telemetry: Deprecate prometheus.zeek policy script
With Cluster::Node$metrics_port being optional, there's not really
a need for the extra script. New rule, if a metrics_port is set, the
node will attempt to listen on it.

Users can still redef Telemetry::metrics_port *after*
base/frameworks/telemetry was loaded to change the port defined
in cluster-layout.zeek.
2024-07-21 17:49:21 +02:00
Christian Kreibich
3ecacf4f50 Comment-only tweaks for telemetry-related settings.
These weren't quite accurate any more.
2024-07-08 23:05:24 -07:00
Tim Wojtulewicz
6821a41c4e Move the options from policy/tuning/defaults to actual Zeek defaults, deprecate that package 2024-05-06 11:13:04 -07:00
Arne Welzel
0b317aced3 telemetry: Disable metrics centralization by default
Move the telemetry/cluster.zeek file over into policy/frameworks/telemetry/prometheus.zeek.

Mention it in local.zeek.

Relates to zeek/broker#366.
2023-06-21 20:13:55 +02:00
Christian Kreibich
b90351b7e6 policy: Import zeek-community-id scripts into protocols/conn frameworks/notice
Slightly adapted for indentation.
2023-04-24 09:43:19 +02:00
Arne Welzel
6dc585bd8c Deprecate misc/scan.zeek
Update bare-mode-errors test to ignore that specific message.
2022-08-23 09:10:53 +02:00
Arne Welzel
3fe930dbf2 Introduce telemetry framework
Adds base/frameworks/telemetry with wrappers around telemetry.bif
and updates telemetry/Manager to support collecting metrics from
script land.

Add policy/frameworks/telemetry/log for logging of metrics data
into a new telemetry.log and telemetry_histogram.log and add into
local.zeek by default.
2022-08-05 11:43:44 +02:00
Johanna Amann
311e113ff6 Deprecate ICSI SSL notary script.
The ICSI notary is pretty much inactive. Furthermore - this approach
does no longer make much sense at this point of time - performing, e.g.,
signed certificate timestamp validation is much more worthwhile.
2021-06-29 09:34:29 +01:00
Christian Kreibich
d1d218b5cc Install zkg as part of the Zeek distribution.
- Add auxil/package-manager submodule as an optional build
  source. When the submodule is present, zkg gets installed into the
  Zeek installation's bin directory, its config file into etc/zkg, and
  its state into var/lib/zkg. Like zeekctl, zkg finds its own module
  independently of any PYTHONPATH. Installation via pip remains
  supported. You can skip zkg explicitly via --disable-zkg. See the
  NEWS update for details.

- Establish a "zeek/python" subdirectory under libdir as the common place
  for Python modules in the Zeek distribution. This now separates out
  the Broker Python bindings, ZeekControl, and zkg's Python module.

- Add configure flags to allow customizing this Python folder, in
  three ways: --python-dir, --python-prefix, and --python-home. These
  differ in the logic they automatically add to the path, and build on
  the logic already used in Broker.

- Include a (comented-out) @load for zkg's packages folder in
  local.zeek.

- Bump zeekctl to move to this new location.

- Bump doc to include installation instructions

- Update NEWS accordingly.
2020-12-11 18:43:47 -08:00
Johanna Amann
3bce313b12 Switch file UID hashing from md5 to highwayhash.
This commit switches UID hashing from md5 to a highway hash. It also
moves the salt value out of the file plugin - and makes it
installation-specific instead - it is moved to the global namespace.

There now are digest hash functions to make "static"
installation-specific hashes that are stable over workers available to
everyone; hashes can be 64, 128 or 256 bits in size.

Due to the fact that we switch the file hashing algorithm, all file
hashes change.

The underlyigng algorithm that is used for hashing is highwayhash-128,
which is significantly faster than md5.
2020-04-30 10:20:09 -07:00
Jon Siwek
9c8db5f6ca Stop loading scan detection in local.zeek by default 2019-09-16 10:51:50 -07:00
Daniel Thayer
18bd74454b Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
Renamed from scripts/site/local.bro (Browse further)