mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 18:18:19 +00:00
091c8f3ebc
- No output by default yet. Most of the activity is centered around generating the Unified2::alert event which ties together an IDSEvent and a packet.
21 lines
351 B
JavaScript
21 lines
351 B
JavaScript
|
|
%include binpac.pac
|
|
%include bro.pac
|
|
|
|
analyzer Unified2 withcontext {
|
|
analyzer: Unified2_Analyzer;
|
|
flow: Flow;
|
|
};
|
|
|
|
analyzer Unified2_Analyzer(bro_analyzer: BroFileAnalyzer) {
|
|
downflow = Flow;
|
|
upflow = Flow;
|
|
};
|
|
|
|
%include unified2-file.pac
|
|
|
|
flow Flow {
|
|
flowunit = Record withcontext(connection, this);
|
|
};
|
|
|
|
%include unified2-analyzer.pac
|