zeek/policy/protocols/http/var-extraction-uri.bro
2011-06-01 10:07:53 -04:00

16 lines
391 B
Text

##! This script extracts and logs variables from the requested URI
@load http/base
@load http/utils
module HTTP;
redef record Info += {
uri_vars: vector of string &optional &log;
};
event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string) &priority=2
{
c$http$uri_vars = extract_keys(original_URI, /&/);
}