mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 23:58:20 +00:00
18 lines
459 B
Text
18 lines
459 B
Text
# @TEST-EXEC: bro %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
event bro_init()
|
|
{
|
|
Intel::insert([$str="bad.com", $subtype=Intel::DNS_ZONE, $meta=[$source="src1", $class=Intel::MALICIOUS]]);
|
|
local q: Intel::Query = [$str="some.host.bad.com", $subtype=Intel::DOMAIN, $class=Intel::MALICIOUS];
|
|
if ( Intel::query(q) )
|
|
{
|
|
print "It matched!";
|
|
local items = Intel::lookup(q);
|
|
for ( item in items )
|
|
{
|
|
print item$str;
|
|
print item$subtype;
|
|
}
|
|
}
|
|
}
|