zeek/testing/btest/scripts/policy/protocols/http/var-extraction-uri.zeek at 2c9015d247143947fc4983c75264ae7f38e3cf6d - Mirror/zeek - git.uphillsecurity.com: We code.

Mirror/zeek

mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00

Benjamin Grap fafc0212a5 Changed behavior of var-extraction-uri.zeek from policy/protocol/http to extract only the URI parameter names. Do not include the path in the first parameter name. Only extract uri vars if parameters actually exist.

2025-08-13 22:45:20 +02:00

5 lines

218 B

Text

Raw Blame History

 # @TEST-EXEC: zeek -r ${TRACES}/http/http-filename.pcap %INPUT
 # @TEST-EXEC: zeek-cut uri uri_vars <http.log > http-reduced.log
 # @TEST-EXEC: btest-diff http-reduced.log
 @load policy/protocols/http/var-extraction-uri