mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
597a4d6704
- policy/ renamed to scripts/ - By default BROPATH now contains: - scripts/ - scripts/policy - scripts/site - *Nearly* all tests pass. - All of scripts/base/ is loaded by main.cc - Can be disabled by setting $BRO_NO_BASE_SCRIPTS - Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script). - The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building. - The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead. - All "detection" activity happens through scripts in scripts/policy/. - Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1) - This is so the communications framework can be loaded as part of the base without causing trouble when it's not needed. - This will be removed once a resolution to ticket #540 is reached.
45 lines
1.3 KiB
Text
45 lines
1.3 KiB
Text
|
|
module Software;
|
|
|
|
export {
|
|
redef enum Notice::Type += {
|
|
## For certain softwares, a version changing may matter. In that case,
|
|
## this notice will be generated. Software that matters if the version
|
|
## changes can be configured with the
|
|
## :bro:id:`Software::interesting_version_changes` variable.
|
|
Software_Version_Change,
|
|
};
|
|
|
|
## Some software is more interesting when the version changes and this
|
|
## a set of all software that should raise a notice when a different
|
|
## version is seen on a host.
|
|
const interesting_version_changes: set[string] = {
|
|
"SSH"
|
|
} &redef;
|
|
|
|
## Some software is more interesting when the version changes and this
|
|
## a set of all software that should raise a notice when a different
|
|
## version is seen on a host.
|
|
const interesting_type_changes: set[string] = {};
|
|
}
|
|
|
|
event log_software(rec: Info)
|
|
{
|
|
local ts = tracked[rec$host];
|
|
|
|
if ( rec$name in ts )
|
|
{
|
|
local old = ts[rec$name];
|
|
|
|
# Is it a potentially interesting version change?
|
|
if ( rec$name in interesting_version_changes )
|
|
{
|
|
local msg = fmt("%.6f %s switched from %s to %s (%s)",
|
|
network_time(), rec$software_type,
|
|
software_fmt_version(old$version),
|
|
software_fmt(rec), rec$software_type);
|
|
NOTICE([$note=Software_Version_Change, $src=rec$host,
|
|
$msg=msg, $sub=software_fmt(rec)]);
|
|
}
|
|
}
|
|
}
|