3 commits

Author	SHA1	Message	Date
Arne Welzel	4027c70e2b	Merge branch 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek ... * 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek: coalesce smtp handlers for ADDR Add fine-grained groups for Intel events (cherry picked from commit d5e1dc27c6)	2025-05-16 11:57:00 +02:00
Arne Welzel	6d19c49efe	intel/seen/file-names: Use file_over_new_connection() ... The seen/file-names script relies on f$info$filename to be populated. For HTTP and other network protocols, however, this field is only populated during file_over_new_connection() that's running after file_new(). Use the file_new() event only for files without connections and file_over_new_connection() implies that f$conns is populated, anyway. Special case SMB to avoid finding files twice, because there's a custom implementation in seen/smb-filenames.zeek. Fixes #2647	2023-01-10 10:10:28 +01:00
Daniel Thayer	18bd74454b	Rename all scripts to have ".zeek" file extension	2019-04-11 21:12:40 -05:00

Renamed from scripts/policy/frameworks/intel/seen/file-names.bro (Browse further)