mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 16:18:19 +00:00
a4af46e1f4
- All 5 intelligence tests pass. - Some initial memory optimizations done. - More work needs done to reduce duplicate data in memory. - Input framework integration. - Define files to read in the "Bro intelligence format" in Intel::read_files. - Cluster transparency. - DNS Zones are a fully supported data type. - Queries for Intel::DOMAIN values will automatically check in DNS_ZONE intelligence.
18 lines
473 B
Text
18 lines
473 B
Text
# @TEST-EXEC: bro %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
event bro_init()
|
|
{
|
|
Intel::insert([$str="bad.com", $subtype=Intel::DNS_ZONE, $meta=[$source="src1", $class=Intel::MALICIOUS]]);
|
|
local query: Intel::Query = [$str="some.host.bad.com", $subtype=Intel::DOMAIN, $class=Intel::MALICIOUS];
|
|
if ( Intel::matcher(query) )
|
|
{
|
|
print "It matched!";
|
|
local items = Intel::lookup(query);
|
|
for ( item in items )
|
|
{
|
|
print item$str;
|
|
print item$subtype;
|
|
}
|
|
}
|
|
}
|