mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
62e0dc94db
This introduces a new hook into the Intel::seen() function that allows users to directly interact with the result of a find() call via external scripts. This should solve the use-case brought up by @chrisanag1985 in discussion #3256: Recording and acting on "no intel match found". @Canon88 was recently asking on Slack about enabling HTTP logging for a given connection only when an Intel match occurred and found that the Intel::match() event would only occur on the manager. The Intel::match_remote() event might be a workaround, but possibly running a bit too late and also it's just an internal "detail" event that might not be stable. Another internal use case revolved around enabling packet recording based on Intel matches which necessarily needs to happen on the worker where the match happened. The proposed workaround is similar to the above using Intel::match_remote(). This hook also provides an opportunity to rate-limit heavy hitter intel items locally on the worker nodes, or even replacing the event approach currently used with a customized approach.
34 lines
1.2 KiB
Text
34 lines
1.2 KiB
Text
# @TEST-EXEC: btest-bg-run zeekproc zeek -b %INPUT
|
|
# @TEST-EXEC: btest-bg-wait 30
|
|
# @TEST-EXEC: cat zeekproc/reporter.log > output
|
|
# @TEST-EXEC: cat zeekproc/.stdout >> output
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER='sed -E "s/lines [0-9]+-[0-9]+/lines xxx-xxx/g" | $SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps' btest-diff output
|
|
|
|
# @TEST-START-FILE intel.dat
|
|
#fields indicator indicator_type meta.source meta.desc meta.url
|
|
192.168.1.1 Intel::ADDR source1 this host is just plain baaad http://some-data-distributor.com/1
|
|
# @TEST-END-FILE
|
|
|
|
@load base/frameworks/intel
|
|
@load base/frameworks/reporter
|
|
|
|
redef exit_only_after_terminate = T;
|
|
|
|
redef Intel::read_files += { "../intel.dat" };
|
|
redef enum Intel::Where += { SOMEWHERE };
|
|
|
|
event do_it()
|
|
{
|
|
# not existing meta data:
|
|
Intel::remove([$indicator="192.168.1.1", $indicator_type=Intel::ADDR, $meta=[$source="source23"]]);
|
|
# existing:
|
|
Intel::remove([$indicator="192.168.1.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
|
|
# not existing item:
|
|
Intel::remove([$indicator="192.168.1.1", $indicator_type=Intel::ADDR, $meta=[$source="source1"]]);
|
|
terminate();
|
|
}
|
|
|
|
event Intel::read_entry(desc: Input::EventDescription, tpe: Input::Event, item: Intel::Item)
|
|
{
|
|
event do_it();
|
|
}
|