mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
a4af46e1f4
- All 5 intelligence tests pass. - Some initial memory optimizations done. - More work needs done to reduce duplicate data in memory. - Input framework integration. - Define files to read in the "Bro intelligence format" in Intel::read_files. - Cluster transparency. - DNS Zones are a fully supported data type. - Queries for Intel::DOMAIN values will automatically check in DNS_ZONE intelligence.
59 lines
1.6 KiB
Text
59 lines
1.6 KiB
Text
##! Cluster transparency support for the intelligence framework. This is mostly oriented
|
|
##! toward distributing intelligence information across clusters.
|
|
|
|
@load base/frameworks/cluster
|
|
|
|
module Intel;
|
|
|
|
export {
|
|
global cluster_new_item: event(item: Item);
|
|
global cluster_updated_item: event(item: Item);
|
|
|
|
redef record Item += {
|
|
## This field is solely used internally for cluster transparency with
|
|
## the intelligence framework to avoid storms of intelligence data
|
|
## swirling forever. It allows data to propagate only a single time.
|
|
first_dispatch: bool &default=T;
|
|
};
|
|
}
|
|
|
|
# Primary intelligence distribution comes from manager.
|
|
redef Cluster::manager2worker_events += /Intel::cluster_(new|updated)_item/;
|
|
# If a worker finds intelligence and adds it, it should share it back to the manager.
|
|
redef Cluster::worker2manager_events += /Intel::cluster_(new|updated)_item/;
|
|
|
|
event Intel::cluster_new_item(item: Intel::Item)
|
|
{
|
|
# Ignore locally generated events.
|
|
if ( is_remote_event() )
|
|
Intel::insert(item);
|
|
}
|
|
|
|
event Intel::cluster_updated_item(item: Intel::Item)
|
|
{
|
|
# Ignore locally generated events.
|
|
if ( is_remote_event() )
|
|
Intel::insert(item);
|
|
}
|
|
|
|
event Intel::new_item(item: Intel::Item)
|
|
{
|
|
# If this is the first time this item has been dispatched,
|
|
# send it over the cluster.
|
|
if ( item$first_dispatch )
|
|
{
|
|
item$first_dispatch = F;
|
|
event Intel::cluster_new_item(item);
|
|
}
|
|
}
|
|
|
|
event Intel::updated_item(item: Intel::Item)
|
|
{
|
|
# If this is the first time this item has been dispatched,
|
|
# send it over the cluster.
|
|
if ( item$first_dispatch )
|
|
{
|
|
item$first_dispatch = F;
|
|
event Intel::cluster_updated_item(item);
|
|
}
|
|
}
|