zeek/policy/frameworks/metrics/conn-example.bro
Seth Hall 9253157302 Updates for the metrics framework.
- Partially responding to Robin's comments on it.
2011-06-14 13:37:03 -04:00

19 lines
No EOL
461 B
Text

@load metrics/base
redef enum Metrics::ID += {
CONNS_ORIGINATED,
CONNS_RESPONDED
};
event bro_init()
{
Metrics::configure(CONNS_ORIGINATED, [$aggregation_mask=24, $break_interval=5mins]);
Metrics::configure(CONNS_RESPONDED, [$aggregation_mask=24, $break_interval=5mins]);
}
event connection_established(c: connection)
{
Metrics::add_data(CONNS_ORIGINATED, [$host=c$id$orig_h], 1);
Metrics::add_data(CONNS_RESPONDED, [$host=c$id$resp_h], 1);
}