zeek/doc/scripts/test-all-policy.zeek.rst

:tocdepth: 3

test-all-policy.zeek
====================


:Imports: :doc:`policy/files/x509/disable-certificate-events-known-certs.zeek </scripts/policy/files/x509/disable-certificate-events-known-certs.zeek>`, :doc:`policy/frameworks/analyzer/debug-logging.zeek </scripts/policy/frameworks/analyzer/debug-logging.zeek>`, :doc:`policy/frameworks/analyzer/detect-protocols.zeek </scripts/policy/frameworks/analyzer/detect-protocols.zeek>`, :doc:`policy/frameworks/analyzer/packet-segment-logging.zeek </scripts/policy/frameworks/analyzer/packet-segment-logging.zeek>`, :doc:`policy/frameworks/cluster/backend/zeromq/__load__.zeek </scripts/policy/frameworks/cluster/backend/zeromq/__load__.zeek>`, :doc:`policy/frameworks/cluster/backend/zeromq/main.zeek </scripts/policy/frameworks/cluster/backend/zeromq/main.zeek>`, :doc:`policy/frameworks/cluster/experimental.zeek </scripts/policy/frameworks/cluster/experimental.zeek>`, :doc:`policy/frameworks/files/detect-MHR.zeek </scripts/policy/frameworks/files/detect-MHR.zeek>`, :doc:`policy/frameworks/files/entropy-test-all-files.zeek </scripts/policy/frameworks/files/entropy-test-all-files.zeek>`, :doc:`policy/frameworks/files/hash-all-files.zeek </scripts/policy/frameworks/files/hash-all-files.zeek>`, :doc:`policy/frameworks/intel/do_expire.zeek </scripts/policy/frameworks/intel/do_expire.zeek>`, :doc:`policy/frameworks/intel/do_notice.zeek </scripts/policy/frameworks/intel/do_notice.zeek>`, :doc:`policy/frameworks/intel/removal.zeek </scripts/policy/frameworks/intel/removal.zeek>`, :doc:`policy/frameworks/intel/seen/__load__.zeek </scripts/policy/frameworks/intel/seen/__load__.zeek>`, :doc:`policy/frameworks/intel/seen/conn-established.zeek </scripts/policy/frameworks/intel/seen/conn-established.zeek>`, :doc:`policy/frameworks/intel/seen/dns.zeek </scripts/policy/frameworks/intel/seen/dns.zeek>`, :doc:`policy/frameworks/intel/seen/file-hashes.zeek </scripts/policy/frameworks/intel/seen/file-hashes.zeek>`, :doc:`policy/frameworks/intel/seen/file-names.zeek </scripts/policy/frameworks/intel/seen/file-names.zeek>`, :doc:`policy/frameworks/intel/seen/http-headers.zeek </scripts/policy/frameworks/intel/seen/http-headers.zeek>`, :doc:`policy/frameworks/intel/seen/http-url.zeek </scripts/policy/frameworks/intel/seen/http-url.zeek>`, :doc:`policy/frameworks/intel/seen/manage-event-groups.zeek </scripts/policy/frameworks/intel/seen/manage-event-groups.zeek>`, :doc:`policy/frameworks/intel/seen/pubkey-hashes.zeek </scripts/policy/frameworks/intel/seen/pubkey-hashes.zeek>`, :doc:`policy/frameworks/intel/seen/smb-filenames.zeek </scripts/policy/frameworks/intel/seen/smb-filenames.zeek>`, :doc:`policy/frameworks/intel/seen/smtp-url-extraction.zeek </scripts/policy/frameworks/intel/seen/smtp-url-extraction.zeek>`, :doc:`policy/frameworks/intel/seen/smtp.zeek </scripts/policy/frameworks/intel/seen/smtp.zeek>`, :doc:`policy/frameworks/intel/seen/ssl.zeek </scripts/policy/frameworks/intel/seen/ssl.zeek>`, :doc:`policy/frameworks/intel/seen/where-locations.zeek </scripts/policy/frameworks/intel/seen/where-locations.zeek>`, :doc:`policy/frameworks/intel/seen/x509.zeek </scripts/policy/frameworks/intel/seen/x509.zeek>`, :doc:`policy/frameworks/intel/whitelist.zeek </scripts/policy/frameworks/intel/whitelist.zeek>`, :doc:`policy/frameworks/management/__load__.zeek </scripts/policy/frameworks/management/__load__.zeek>`, :doc:`policy/frameworks/management/agent/__load__.zeek </scripts/policy/frameworks/management/agent/__load__.zeek>`, :doc:`policy/frameworks/management/agent/api.zeek </scripts/policy/frameworks/management/agent/api.zeek>`, :doc:`policy/frameworks/management/agent/boot.zeek </scripts/policy/frameworks/management/agent/boot.zeek>`, :doc:`policy/frameworks/management/agent/config.zeek </scripts/policy/frameworks/management/agent/config.zeek>`, :doc:`policy/frameworks/management/config.zeek </scripts/policy/frameworks/management/config.zeek>`, :doc:`policy/frameworks/management/controller/__load__.zeek </scripts/policy/frameworks/management/controller/__load__.zeek>`, :doc:`policy/frameworks/management/controller/api.zeek </scripts/policy/frameworks/management/controller/api.zeek>`, :doc:`policy/frameworks/management/controller/boot.zeek </scripts/policy/frameworks/management/controller/boot.zeek>`, :doc:`policy/frameworks/management/controller/config.zeek </scripts/policy/frameworks/management/controller/config.zeek>`, :doc:`policy/frameworks/management/log.zeek </scripts/policy/frameworks/management/log.zeek>`, :doc:`policy/frameworks/management/node/api.zeek </scripts/policy/frameworks/management/node/api.zeek>`, :doc:`policy/frameworks/management/node/config.zeek </scripts/policy/frameworks/management/node/config.zeek>`, :doc:`policy/frameworks/management/persistence.zeek </scripts/policy/frameworks/management/persistence.zeek>`, :doc:`policy/frameworks/management/request.zeek </scripts/policy/frameworks/management/request.zeek>`, :doc:`policy/frameworks/management/supervisor/__load__.zeek </scripts/policy/frameworks/management/supervisor/__load__.zeek>`, :doc:`policy/frameworks/management/supervisor/api.zeek </scripts/policy/frameworks/management/supervisor/api.zeek>`, :doc:`policy/frameworks/management/supervisor/config.zeek </scripts/policy/frameworks/management/supervisor/config.zeek>`, :doc:`policy/frameworks/management/supervisor/main.zeek </scripts/policy/frameworks/management/supervisor/main.zeek>`, :doc:`policy/frameworks/management/types.zeek </scripts/policy/frameworks/management/types.zeek>`, :doc:`policy/frameworks/management/util.zeek </scripts/policy/frameworks/management/util.zeek>`, :doc:`policy/frameworks/netcontrol/catch-and-release.zeek </scripts/policy/frameworks/netcontrol/catch-and-release.zeek>`, :doc:`policy/frameworks/notice/__load__.zeek </scripts/policy/frameworks/notice/__load__.zeek>`, :doc:`policy/frameworks/notice/actions/drop.zeek </scripts/policy/frameworks/notice/actions/drop.zeek>`, :doc:`policy/frameworks/notice/community-id.zeek </scripts/policy/frameworks/notice/community-id.zeek>`, :doc:`policy/frameworks/notice/extend-email/hostnames.zeek </scripts/policy/frameworks/notice/extend-email/hostnames.zeek>`, :doc:`policy/frameworks/packet-filter/shunt.zeek </scripts/policy/frameworks/packet-filter/shunt.zeek>`, :doc:`policy/frameworks/software/version-changes.zeek </scripts/policy/frameworks/software/version-changes.zeek>`, :doc:`policy/frameworks/software/vulnerable.zeek </scripts/policy/frameworks/software/vulnerable.zeek>`, :doc:`policy/frameworks/software/windows-version-detection.zeek </scripts/policy/frameworks/software/windows-version-detection.zeek>`, :doc:`policy/frameworks/storage/backend/redis/__load__.zeek </scripts/policy/frameworks/storage/backend/redis/__load__.zeek>`, :doc:`policy/frameworks/storage/backend/redis/main.zeek </scripts/policy/frameworks/storage/backend/redis/main.zeek>`, :doc:`policy/frameworks/storage/backend/sqlite/__load__.zeek </scripts/policy/frameworks/storage/backend/sqlite/__load__.zeek>`, :doc:`policy/frameworks/storage/backend/sqlite/main.zeek </scripts/policy/frameworks/storage/backend/sqlite/main.zeek>`, :doc:`policy/frameworks/telemetry/log.zeek </scripts/policy/frameworks/telemetry/log.zeek>`, :doc:`policy/integration/collective-intel/__load__.zeek </scripts/policy/integration/collective-intel/__load__.zeek>`, :doc:`policy/integration/collective-intel/main.zeek </scripts/policy/integration/collective-intel/main.zeek>`, :doc:`policy/misc/capture-loss.zeek </scripts/policy/misc/capture-loss.zeek>`, :doc:`policy/misc/detect-traceroute/__load__.zeek </scripts/policy/misc/detect-traceroute/__load__.zeek>`, :doc:`policy/misc/detect-traceroute/main.zeek </scripts/policy/misc/detect-traceroute/main.zeek>`, :doc:`policy/misc/loaded-scripts.zeek </scripts/policy/misc/loaded-scripts.zeek>`, :doc:`policy/misc/profiling.zeek </scripts/policy/misc/profiling.zeek>`, :doc:`policy/misc/stats.zeek </scripts/policy/misc/stats.zeek>`, :doc:`policy/misc/trim-trace-file.zeek </scripts/policy/misc/trim-trace-file.zeek>`, :doc:`policy/misc/unknown-protocols.zeek </scripts/policy/misc/unknown-protocols.zeek>`, :doc:`policy/misc/weird-stats.zeek </scripts/policy/misc/weird-stats.zeek>`, :doc:`policy/protocols/conn/community-id-logging.zeek </scripts/policy/protocols/conn/community-id-logging.zeek>`, :doc:`policy/protocols/conn/disable-unknown-ip-proto-support.zeek </scripts/policy/protocols/conn/disable-unknown-ip-proto-support.zeek>`, :doc:`policy/protocols/conn/failed-service-logging.zeek </scripts/policy/protocols/conn/failed-service-logging.zeek>`, :doc:`policy/protocols/conn/ip-proto-name-logging.zeek </scripts/policy/protocols/conn/ip-proto-name-logging.zeek>`, :doc:`policy/protocols/conn/known-hosts.zeek </scripts/policy/protocols/conn/known-hosts.zeek>`, :doc:`policy/protocols/conn/known-services.zeek </scripts/policy/protocols/conn/known-services.zeek>`, :doc:`policy/protocols/conn/mac-logging.zeek </scripts/policy/protocols/conn/mac-logging.zeek>`, :doc:`policy/protocols/conn/pppoe-session-id-logging.zeek </scripts/policy/protocols/conn/pppoe-session-id-logging.zeek>`, :doc:`policy/protocols/conn/vlan-logging.zeek </scripts/policy/protocols/conn/vlan-logging.zeek>`, :doc:`policy/protocols/conn/weirds.zeek </scripts/policy/protocols/conn/weirds.zeek>`, :doc:`policy/protocols/dhcp/msg-orig.zeek </scripts/policy/protocols/dhcp/msg-orig.zeek>`, :doc:`policy/protocols/dhcp/software.zeek </scripts/policy/protocols/dhcp/software.zeek>`, :doc:`policy/protocols/dhcp/sub-opts.zeek </scripts/policy/protocols/dhcp/sub-opts.zeek>`, :doc:`policy/protocols/dns/auth-addl.zeek </scripts/policy/protocols/dns/auth-addl.zeek>`, :doc:`policy/protocols/dns/detect-external-names.zeek </scripts/policy/protocols/dns/detect-external-names.zeek>`, :doc:`policy/protocols/dns/log-original-query-case.zeek </scripts/policy/protocols/dns/log-original-query-case.zeek>`, :doc:`policy/protocols/ftp/detect-bruteforcing.zeek </scripts/policy/protocols/ftp/detect-bruteforcing.zeek>`, :doc:`policy/protocols/ftp/detect.zeek </scripts/policy/protocols/ftp/detect.zeek>`, :doc:`policy/protocols/ftp/software.zeek </scripts/policy/protocols/ftp/software.zeek>`, :doc:`policy/protocols/http/detect-sql-injection.zeek </scripts/policy/protocols/http/detect-sql-injection.zeek>`, :doc:`policy/protocols/http/detect-webapps.zeek </scripts/policy/protocols/http/detect-webapps.zeek>`, :doc:`policy/protocols/http/header-names.zeek </scripts/policy/protocols/http/header-names.zeek>`, :doc:`policy/protocols/http/software-browser-plugins.zeek </scripts/policy/protocols/http/software-browser-plugins.zeek>`, :doc:`policy/protocols/http/software.zeek </scripts/policy/protocols/http/software.zeek>`, :doc:`policy/protocols/http/var-extraction-cookies.zeek </scripts/policy/protocols/http/var-extraction-cookies.zeek>`, :doc:`policy/protocols/http/var-extraction-uri.zeek </scripts/policy/protocols/http/var-extraction-uri.zeek>`, :doc:`policy/protocols/krb/ticket-logging.zeek </scripts/policy/protocols/krb/ticket-logging.zeek>`, :doc:`policy/protocols/modbus/known-masters-slaves.zeek </scripts/policy/protocols/modbus/known-masters-slaves.zeek>`, :doc:`policy/protocols/modbus/track-memmap.zeek </scripts/policy/protocols/modbus/track-memmap.zeek>`, :doc:`policy/protocols/mysql/software.zeek </scripts/policy/protocols/mysql/software.zeek>`, :doc:`policy/protocols/rdp/indicate_ssl.zeek </scripts/policy/protocols/rdp/indicate_ssl.zeek>`, :doc:`policy/protocols/smb/log-cmds.zeek </scripts/policy/protocols/smb/log-cmds.zeek>`, :doc:`policy/protocols/smtp/blocklists.zeek </scripts/policy/protocols/smtp/blocklists.zeek>`, :doc:`policy/protocols/smtp/detect-suspicious-orig.zeek </scripts/policy/protocols/smtp/detect-suspicious-orig.zeek>`, :doc:`policy/protocols/smtp/entities-excerpt.zeek </scripts/policy/protocols/smtp/entities-excerpt.zeek>`, :doc:`policy/protocols/smtp/software.zeek </scripts/policy/protocols/smtp/software.zeek>`, :doc:`policy/protocols/ssh/detect-bruteforcing.zeek </scripts/policy/protocols/ssh/detect-bruteforcing.zeek>`, :doc:`policy/protocols/ssh/geo-data.zeek </scripts/policy/protocols/ssh/geo-data.zeek>`, :doc:`policy/protocols/ssh/interesting-hostnames.zeek </scripts/policy/protocols/ssh/interesting-hostnames.zeek>`, :doc:`policy/protocols/ssh/software.zeek </scripts/policy/protocols/ssh/software.zeek>`, :doc:`policy/protocols/ssl/certificate-request-info.zeek </scripts/policy/protocols/ssl/certificate-request-info.zeek>`, :doc:`policy/protocols/ssl/decryption.zeek </scripts/policy/protocols/ssl/decryption.zeek>`, :doc:`policy/protocols/ssl/expiring-certs.zeek </scripts/policy/protocols/ssl/expiring-certs.zeek>`, :doc:`policy/protocols/ssl/heartbleed.zeek </scripts/policy/protocols/ssl/heartbleed.zeek>`, :doc:`policy/protocols/ssl/known-certs.zeek </scripts/policy/protocols/ssl/known-certs.zeek>`, :doc:`policy/protocols/ssl/log-certs-base64.zeek </scripts/policy/protocols/ssl/log-certs-base64.zeek>`, :doc:`policy/protocols/ssl/log-hostcerts-only.zeek </scripts/policy/protocols/ssl/log-hostcerts-only.zeek>`, :doc:`policy/protocols/ssl/ssl-log-ext.zeek </scripts/policy/protocols/ssl/ssl-log-ext.zeek>`, :doc:`policy/protocols/ssl/validate-certs.zeek </scripts/policy/protocols/ssl/validate-certs.zeek>`, :doc:`policy/protocols/ssl/validate-ocsp.zeek </scripts/policy/protocols/ssl/validate-ocsp.zeek>`, :doc:`policy/protocols/ssl/validate-sct.zeek </scripts/policy/protocols/ssl/validate-sct.zeek>`, :doc:`policy/protocols/ssl/weak-keys.zeek </scripts/policy/protocols/ssl/weak-keys.zeek>`, :doc:`policy/tuning/json-logs.zeek </scripts/policy/tuning/json-logs.zeek>`, :doc:`policy/tuning/track-all-assets.zeek </scripts/policy/tuning/track-all-assets.zeek>`

Summary
~~~~~~~

Detailed Interface
~~~~~~~~~~~~~~~~~~