mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
51e738a1c0
This introduces a new sampling state-map for expired connections to fix segfaults that previously occured when passing in a `connection` record to `Reporter::conn_weird()` for which the internal `Connection` object had already been expired and deleted. This also introduces a new event called `expired_conn_weird`, which is similar to `conn_weird`, except the full `connection` record is no longer available, just the `conn_id` and UID string. |
||
|---|---|---|
| .. | ||
| actions | ||
| __load__.zeek | ||
| main.zeek | ||
| README | ||
| weird.zeek | ||
The notice framework enables Zeek to "notice" things which are odd or potentially bad, leaving it to the local configuration to define which of them are actionable. This decoupling of detection and reporting allows Zeek to be customized to the different needs that sites have.