Commit graph

8 commits

Author SHA1 Message Date
Arne Welzel
fa956efa79 file_analysis/Analyzer: Limit maximum number of violations
Just the same as for protocol analyzers, prevent from violation event overload.
2022-11-08 16:44:39 -07:00
Arne Welzel
d5cd023dff file_analysis: Implement AnalyzerViolation() for file_analysis/Analyzer
Add a test parsing a malformed PE file showing that analyzer_violation_info
is raised with the fa_file object set.

It could be interesting to pass through an optional connection if one
exists, but access is provided through f$conns, too.
2022-09-27 17:49:58 +02:00
Jon Siwek
23ad81400b Rename aux/ to auxil/
Since "aux" is not an allowed file/dir name on Windows.
2020-06-04 15:18:44 -07:00
Jon Siwek
c6378c56e2 Update plugin unit tests to use --zeek-dist 2019-06-06 20:02:47 -07:00
Daniel Thayer
1a74516db1 Rename all BRO-prefixed environment variables
For backward compatibility when reading values, we first check
the ZEEK-prefixed value, and if not set, then check the corresponding
BRO-prefixed value.
2019-05-22 00:12:31 -05:00
Daniel Thayer
3f9e7138bd More bro-to-zeek renaming in the unit tests 2019-05-16 02:27:54 -05:00
Robin Sommer
789cb376fd GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.

The btests pass, but this is still WIP. broctl renaming is still
missing.

#239
2019-05-01 21:43:45 +00:00
Jon Siwek
1e57e3f026 Use .zeek file suffix in unit tests 2019-04-16 16:08:57 -07:00
Renamed from testing/btest/plugins/file.bro (Browse further)