Commit graph

577 commits

Author SHA1 Message Date
Robin Sommer
bd63cf2e36 Merge remote-tracking branch 'origin/topic/jazoff/notice_file_info'
* origin/topic/jazoff/notice_file_info:
  Include file information in notices

BIT-1113 #merged

I'm wondering if there's a way to test creating these emails ... ?
2014-01-20 12:01:44 -08:00
Justin Azoff
852af5d02e Include file information in notices
Add file_desc and file_mime_type information to notice output if it
exists in the notice.
2014-01-13 17:01:51 -05:00
Justin Azoff
ec3f684c61 change Notice::suppressing to be a table of times
Instead of storing the entire notice in Notice::suppressing,
just store the time the notice should be suppressed until.

This has the same functionality, except that end_suppression can no
longer be generated.
2013-12-31 10:09:44 -05:00
Robin Sommer
5049d68c1b Merge remote-tracking branch 'origin/topic/seth/ie11-software-parsing'
* origin/topic/seth/ie11-software-parsing:
  Updated software framework to support parsing IE11 user-agent strings.
  Fix the irc_reply event for several server message types.

BIT-1104 #merged
2013-12-09 13:21:20 -08:00
Seth Hall
6d782e6834 Updated software framework to support parsing IE11 user-agent strings. 2013-12-05 15:05:11 -05:00
Jon Siwek
96ba5c82a3 Merge branch 'master' into topic/jsiwek/broxygen 2013-11-21 15:46:55 -06:00
Jon Siwek
9967aea52c Integrate new Broxygen functionality into Sphinx.
Add a "broxygen" domain Sphinx extension w/ directives to allow
on-the-fly documentation to be generated w/ Bro and included in files.

This means all autogenerated reST docs are now done by Bro.  The odd
CMake/Python glue scipts which used to generate some portions are now
gone.  Bro and the Sphinx extension handle checking for outdated docs
themselves.

Parallel builds of `make doc` target should now work (mostly because
I don't think there's any tasks that can be done in parallel anymore).

Overall, this seems to simplify things and make the Broxygen-generated
portions of the documentation visible/traceable from the main Sphinx
source tree.  The one odd thing still is that per-script documentation
is rsync'd in to a shadow copy of the Sphinx source tree within the
build dir.  This is less elegant than using the new broxygen extension
to make per-script docs, but rsync is faster and simpler.  Simpler as in
less code because it seems like, in the best case, I'd need to write a
custom Sphinx Builder to be able to get that to even work.
2013-11-21 14:34:32 -06:00
Robin Sommer
da9c31db55 Fixing warnings during doc build.
Includes adding a stub file that has been missing for a while already.
2013-11-07 00:46:48 -08:00
Robin Sommer
2818bb3dbc Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  make the documentation of the SQLite reader/writer a bit nicer.
  Wrong example file was included - reported by Michael Auger @LM4K
2013-10-25 11:12:51 -07:00
Bernhard Amann
a09d8e94e0 make the documentation of the SQLite reader/writer a bit nicer. 2013-10-25 10:21:33 -07:00
Robin Sommer
a7cebff99d Merge remote-tracking branch 'origin/topic/dnthayer/doc-changes-for-2.2'
* origin/topic/dnthayer/doc-changes-for-2.2:
  Add gawk to list of optional packages
  Add more script package README files
  Add NEWS about new features of broctl and upgrade info
2013-10-24 14:35:21 -07:00
Seth Hall
ccc7b7669d Merge remote-tracking branch 'origin/topic/seth/fix-packetfilter-log'
* origin/topic/seth/fix-packetfilter-log:
  Hack to make sure that the starting BPF filter is logged on clusters.
2013-10-24 15:36:17 -04:00
Seth Hall
af6e44589f Hack to make sure that the starting BPF filter is logged on clusters. 2013-10-24 14:55:37 -04:00
Daniel Thayer
72a4a90416 Add more script package README files
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.
2013-10-23 16:36:14 -05:00
Daniel Thayer
4b8171f74a Document which Bro script vars are set by BroControl 2013-10-22 16:40:29 -05:00
Daniel Thayer
1b26c05c2c Add more script package README files
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.
2013-10-22 14:44:59 -05:00
Daniel Thayer
e724e5d392 Do not include documentation of commented-out items
Some documentation of commented-out items was being output to HTML,
which was causing that documentation to be merged with the
documentation of the next item.  Fixed by changing "##" to "#" so
that the doc comments are not included in the HTML.
2013-10-22 13:46:09 -05:00
Daniel Thayer
f5d6931f00 Fix typos and formatting in the signature framework docs 2013-10-22 09:37:43 -05:00
Daniel Thayer
5a0e3dda7e Fix typos and formatting in the notice framework docs 2013-10-22 09:16:29 -05:00
Robin Sommer
615cca8baa Merge remote-tracking branch 'origin/topic/dnthayer/doc-changes-for-2.2'
Snapshotting the work in this branch. I'll merge it again later as we
get closer to the release.

* origin/topic/dnthayer/doc-changes-for-2.2: (29 commits)
  Add README files for base/protocols
  Fix incorrect uses of reST directives
  Fix typos and formatting in the BiFs docs
  Fix typos and formatting in the base/utils docs
  Fix typos and formatting in the other protocol docs
  Fix typos and formatting in the ssl protocol docs
  Fix typos and formatting in the http protocol docs
  Fix typos and formatting in the ftp protocol docs
  Fix typos and formatting in the dns protocol docs
  Fix typos and formatting in the dhcp protocol docs
  Adjust line numbers to match changes in conn/main.bro
  Fix typos and formatting in the conn protocol docs
  Update FreeBSD install instructions
  Improvements to file analysis docs
  Add README files for most Bro frameworks
  Fix typos and formatting in various other framework docs
  Fix typos and formatting in the software framework docs
  Fix typos and formatting in the sumstats docs
  Fix typos and formatting in the packet filter docs
  Fix typos and formatting in the logging framework docs
  ...
2013-10-18 13:49:49 -07:00
Daniel Thayer
b5af589246 Improvements to file analysis docs
Fixed reference to wrong field name.
Added documentation of a function arg.
Added a couple references to other parts of the documentation.
Explained how not specifying extraction filename results in automatic
filename generation.
Several other minor clarifications.
2013-10-11 16:31:53 -05:00
Daniel Thayer
60b2c5f1fe Add README files for most Bro frameworks
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.  The text for these was mostly just
copied from the existing docs.
2013-10-11 00:19:37 -05:00
Daniel Thayer
50aca717d0 Fix typos and formatting in various other framework docs 2013-10-10 23:18:27 -05:00
Daniel Thayer
960ddc22d1 Fix typos and formatting in the software framework docs 2013-10-10 23:16:19 -05:00
Daniel Thayer
0753853726 Fix typos and formatting in the sumstats docs 2013-10-10 23:15:12 -05:00
Daniel Thayer
3812716ace Fix typos and formatting in the packet filter docs 2013-10-10 20:44:31 -05:00
Daniel Thayer
ee921a419f Fix typos and formatting in the logging framework docs 2013-10-10 16:10:00 -05:00
Daniel Thayer
ff15e0832f Fix typos and formatting in the intel framework docs 2013-10-10 15:23:19 -05:00
Daniel Thayer
e2c5a5c4a5 Fix typos and formatting in the communication framework doc
Fixed a link that was pointing to the wrong "connect".
2013-10-10 14:42:01 -05:00
Daniel Thayer
f21f45ac1a Fix typos and formatting in the cluster framework docs
Changed a Time Machine link to point to something useful.
2013-10-10 14:39:44 -05:00
Daniel Thayer
0d712b35d8 Fix typos and a broken link in the file analysis doc 2013-10-10 12:23:34 -05:00
Daniel Thayer
1a36031874 Fix typos and formatting in the input framework docs 2013-10-10 00:53:13 -05:00
Seth Hall
706363a295 Fixes for the 2.2 beta. 2013-09-25 16:44:39 -04:00
Robin Sommer
c6de23ebe1 Merge remote-tracking branch 'origin/topic/bernhard/ticket1072'
* origin/topic/bernhard/ticket1072:
  and const 2 more functions
  update hll documentation, make a few functions private and create a new copy constructor.
  fix case where hll_error_margin could be undefined (thanks John)

BIT-1072 #merged
2013-09-18 15:00:06 -07:00
Bernhard Amann
9834755948 fix case where hll_error_margin could be undefined (thanks John) 2013-09-11 12:50:29 -07:00
Seth Hall
7c1dffa66f Fixed an issue with the HLL_UNIQUE SumStats plugin that caused a reporter error. 2013-09-06 15:31:00 -04:00
Jon Siwek
a9a245e017 Workaround type ambiguity w/ default record field. 2013-09-05 16:41:51 -05:00
Seth Hall
ef50802fd7 Make the notice $actions field have a default empty set to avoid having to check for it's presence. 2013-09-05 12:07:21 -04:00
Jon Siwek
db470a637a Documentation fixes.
This cleans up most of the warnings from sphinx (broken :doc: links,
broxygen role misuses, etc.).  The remaining ones should be harmless,
but not quick to silence.

I found that the README for each component was a copy from the actual
repo, so I turned those in to symlinks so they don't get out of date.
2013-09-03 15:59:40 -05:00
Robin Sommer
6f9d28cc18 Merge branch 'topic/robin/hyperloglog-merge'
* topic/robin/hyperloglog-merge: (35 commits)
  Making the confidence configurable.
  Renaming HyperLogLog->CardinalityCounter.
  Fixing bug introduced during merging.
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  ...
2013-08-31 10:42:42 -07:00
Robin Sommer
295987c8d0 Making the confidence configurable. 2013-08-31 10:34:50 -07:00
Robin Sommer
4dcf8fc0db Merge remote-tracking branch 'origin/topic/bernhard/hyperloglog'
* origin/topic/bernhard/hyperloglog: (32 commits)
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  change plugin after feedback of seth
  Forgot a file. Again. Like always. Basically.
  do away with old file.
  ...
2013-08-30 11:30:05 -07:00
Bernhard Amann
dc9fd36497 Merge remote branch 'origin/master' into topic/bernhard/hyperloglog 2013-08-28 17:48:59 -07:00
Seth Hall
2b78922af8 Added a $unique_max field to Reducers for the SumStats::UNIQUE calculation
- Using the new option in scan.bro and the FTP bruteforce detection.
2013-08-28 00:57:44 -04:00
Bernhard Amann
74f96d22ef Merge remote branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/3rdparty
2013-08-26 12:53:13 -07:00
Seth Hall
ea89e30a9c One more tiny SumStats change to clean up cluster state. 2013-08-26 15:29:27 -04:00
Seth Hall
72d2cd363e Removed the when statement from general use in the sumstats cluster code. 2013-08-26 13:57:42 -04:00
Seth Hall
2091bbbf6f Fixing a problem with resetting sumstats on managers in the wrong location. 2013-08-21 14:47:05 -04:00
Seth Hall
22b1e78ec1 Changing how threshold reseting happens (actually do it on managers!) 2013-08-21 14:08:14 -04:00
Seth Hall
1430c28ba3 Merge remote-tracking branch 'origin/master' into topic/seth/sumstats-updates 2013-08-21 12:45:50 -04:00