zeek/policy/frameworks/metrics/conn-example.bro
2011-06-01 10:07:53 -04:00

19 lines
No EOL
448 B
Text

@load metrics/base
redef enum Metrics::ID += {
CONNS_ORIGINATED,
CONNS_RESPONDED
};
event bro_init()
{
Metrics::create(CONNS_ORIGINATED, [$aggregation_mask=24, $break_interval=5mins]);
Metrics::create(CONNS_RESPONDED, [$aggregation_mask=24, $break_interval=5mins]);
}
event connection_established(c: connection)
{
Metrics::add_data(CONNS_ORIGINATED, [$host=c$id$orig_h]);
Metrics::add_data(CONNS_RESPONDED, [$host=c$id$resp_h]);
}