Robin Sommer
789cb376fd
GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
...
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.
The btests pass, but this is still WIP. broctl renaming is still
missing.
#239
2019-05-01 21:43:45 +00:00
Jon Siwek
a994be9eeb
Merge remote-tracking branch 'origin/topic/seth/zeek_init'
...
* origin/topic/seth/zeek_init:
Some more testing fixes.
Update docs and tests for bro_(init|done) -> zeek_(init|done)
Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Jon Siwek
1e57e3f026
Use .zeek file suffix in unit tests
2019-04-16 16:08:57 -07:00
Seth Hall
9d676d368b
Some more testing fixes.
2019-04-14 09:58:30 -04:00
Seth Hall
5db766bd88
Update docs and tests for bro_(init|done) -> zeek_(init|done)
2019-04-14 08:49:12 -04:00
Jon Siwek
8b29df96cc
Merge branch 'master' of https://github.com/hosom/zeek
...
* 'master' of https://github.com/hosom/zeek :
Normalize the intel seen filename for smb.
load smb-filenames in scripts/policy/frameworks/intel/seen/__load__.bro
Add SMB::IN_FILE_NAME to Intel::Where enum
Support filenamess for SMB files
I added a test case
2019-03-25 16:45:59 -07:00
Seth Hall
d6a7322a75
Merge branch 'topic/jgras/intel-update' of https://github.com/J-Gras/bro into topic/seth/intel-update-merge
...
# Conflicts:
# testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
# testing/btest/Baseline/scripts.policy.frameworks.intel.seen.certs/intel-all.log
2016-08-02 15:50:43 -04:00
Seth Hall
6bc7c3f1be
Merge remote-tracking branch 'origin/master' into J-Gras-topic/jgras/bit-1507
...
# Conflicts:
# testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2016-06-15 10:32:46 -04:00
Jan Grashoefer
859eb5eac7
Merge branch 'master' into topic/jgras/intel-update
2016-05-11 18:59:58 +02:00
Johanna Amann
00e759b44c
Intel: CERT_HASH indicator type was never checked
...
Hence, when people specify data of type CERT_HASH in their intel source
files, it will never trigger an alert.
2016-04-11 15:50:55 +02:00
Jan Grashoefer
6f891ca2ff
Added test-case for intel framework matching email
...
Addresses #1507
2015-12-16 14:51:02 +01:00
Johanna Amann
0d9869a2aa
(Hopefully) fix race condition between trace and intel file.
2015-07-15 09:14:36 -07:00
Johanna Amann
946f19fb9d
Use our new features to send the CN and SAN fields of certificates to
...
the intel framework.
2015-03-03 17:15:24 -08:00
