mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
a4af46e1f4
- All 5 intelligence tests pass. - Some initial memory optimizations done. - More work needs done to reduce duplicate data in memory. - Input framework integration. - Define files to read in the "Bro intelligence format" in Intel::read_files. - Cluster transparency. - DNS Zones are a fully supported data type. - Queries for Intel::DOMAIN values will automatically check in DNS_ZONE intelligence.
36 lines
1.1 KiB
Text
36 lines
1.1 KiB
Text
# @TEST-EXEC: bro %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@TEST-START-FILE intel.dat
|
|
#fields ip net str subtype meta.source meta.class meta.desc meta.url meta.tags
|
|
1.2.3.4 - - - source1 Intel::MALICIOUS this host is just plain baaad http://some-data-distributor.com/1234 foo,bar
|
|
1.2.3.4 - - - source1 Intel::MALICIOUS this host is just plain baaad http://some-data-distributor.com/1234 foo,bar
|
|
- - e@mail.com Intel::EMAIL source1 Intel::MALICIOUS Phishing email source http://some-data-distributor.com/100000 -
|
|
@TEST-END-FILE
|
|
|
|
@load frameworks/communication/listen
|
|
|
|
redef Intel::read_files += { "intel.dat" };
|
|
|
|
event do_it(allowed_loops: count)
|
|
{
|
|
if ( Intel::matcher([$str="e@mail.com", $subtype=Intel::EMAIL, $class=Intel::MALICIOUS]) &&
|
|
Intel::matcher([$ip=1.2.3.4, $class=Intel::MALICIOUS]) )
|
|
{
|
|
# Once the match happens a single time we print and shutdown.
|
|
print "Matched it!";
|
|
terminate_communication();
|
|
return;
|
|
}
|
|
|
|
if ( allowed_loops > 0 )
|
|
schedule 100msecs { do_it(allowed_loops-1) };
|
|
else
|
|
terminate_communication();
|
|
}
|
|
|
|
|
|
event bro_init()
|
|
{
|
|
event do_it(20);
|
|
}
|