mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 18:48:20 +00:00
26 lines
1.2 KiB
Text
26 lines
1.2 KiB
Text
.. rst-class:: btest-cmd
|
|
|
|
.. code-block:: none
|
|
:linenos:
|
|
:emphasize-lines: 1,1
|
|
|
|
# bro -r tls/tls-expired-cert.trace conditional-notice.bro
|
|
|
|
.. rst-class:: btest-cmd
|
|
|
|
.. code-block:: none
|
|
:linenos:
|
|
:emphasize-lines: 1,1
|
|
|
|
# cat notice.log
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path notice
|
|
#open 2017-12-21-02-23-46
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for dropped remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
|
|
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval bool string string string double double
|
|
1394745603.293028 CHhAvVGS1DHFjwGM9 192.168.4.149 60539 87.98.220.10 443 F1fX1R2cDOzbvg17ye - - tcp SSL::Certificate_Expired Certificate CN=www.spidh.org,OU=COMODO SSL,OU=Domain Control Validated expired at 2014-03-04-23:59:59.000000000 - 192.168.4.149 87.98.220.10 443 - - Notice::ACTION_EMAIL,Notice::ACTION_LOG 86400.000000 F - - - - -
|
|
#close 2017-12-21-02-23-46
|
|
|