6 commits

Author	SHA1	Message	Date
Jon Siwek	31f60853c9	GH-646: add new "successful_connection_remove" event ... And switch Zeek's base scripts over to using it in place of "connection_state_remove". The difference between the two is that "connection_state_remove" is raised for all events while "successful_connection_remove" excludes TCP connections that were never established (just SYN packets). There can be performance benefits to this change for some use-cases. There's also a new event called ``connection_successful`` and a new ``connection`` record field named "successful" to help indicate this new property of connections.	2019-11-11 19:52:59 -08:00
Vlad Grigorescu	5f0023b3b0	DNS: Add support for SPF response records ... SPF response records are identical to TXT records in structure, and can be parsed and interpreted the same way. However, they have a different RR type, so they would generate weird events and not be parsed by Zeek before this change. Even though they're the same as TXT records from a protocol stance, I created a new event type (dns_SPF_reply), and call the records out as SPF in the logs, instead of as TXT records, since the distinction could be important for detection purposes. SPF records have been obsoleted, but continue to be seen in the wild.	2019-06-14 10:18:37 -05:00
Daniel Thayer	be182aac83	More bro-to-zeek renaming in scripts and other files	2019-05-16 02:36:41 -05:00
Jon Siwek	aebcb1415d	GH-234: rename Broxygen to Zeexygen along with roles/directives ... * All "Broxygen" usages have been replaced in code, documentation, filenames, etc. * Sphinx roles/directives like ":bro:see" are now ":zeek:see" * The "--broxygen" command-line option is now "--zeexygen"	2019-04-22 19:45:50 -07:00
Jon Siwek	a994be9eeb	Merge remote-tracking branch 'origin/topic/seth/zeek_init' ... * origin/topic/seth/zeek_init: Some more testing fixes. Update docs and tests for bro_(init|done) -> zeek_(init|done) Implement the zeek_init handler.	2019-04-19 11:24:29 -07:00
Daniel Thayer	18bd74454b	Rename all scripts to have ".zeek" file extension	2019-04-11 21:12:40 -05:00

Renamed from scripts/base/protocols/dns/main.bro (Browse further)