Commit graph

1 commit

Author SHA1 Message Date
Arne Welzel
6d19c49efe intel/seen/file-names: Use file_over_new_connection()
The seen/file-names script relies on f$info$filename to be populated.
For HTTP and other network protocols, however, this field is only
populated during file_over_new_connection() that's running after
file_new().

Use the file_new() event only for files without connections and
file_over_new_connection() implies that f$conns is populated, anyway.

Special case SMB to avoid finding files twice, because there's a
custom implementation in seen/smb-filenames.zeek.

Fixes #2647
2023-01-10 10:10:28 +01:00