Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
zeek/testing/btest/Baseline/coverage.record-fields/out.default
Johanna Amann af77a7a83b Analyzer failure logging: tweaks and test fixes 
The main part of this commit are changes in tests. A lot of the tests
that previously relied on analyzer.log or dpd.log now use the new
analyzer-failed.log.

I verified all the changes and, as far as I can tell, everything
behaves as it should. This includes the external test baselines.

This change also enables logging of file and packet analyzer to
analyzer_failed.log and fixes some small behavior issues.

The analyzer_failed event is no longer raised when the removal of an
analyzer is vetoed.

If an analyzer is no longer active when an analyzer violation is raised,
currently the analyzer_failed event is raised. This can, e.g., happen
when an analyzer error happens at the very end of the connection. This
makes the behavior more similar to what happened in the past, and also
intuitively seems to make sense.

A bug introduced in the failed service logging was fixed.
2025-06-03 15:56:42 +01:00

954 lines
42 KiB
Text
Raw Blame History

### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
[zeek, <...>/record-fields.zeek]
connection {
* conn: record Conn::Info, log=F, optional=T
Conn::Info {
* conn_state: string, log=T, optional=T
* duration: interval, log=T, optional=T
* history: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id {
* orig_h: addr, log=T, optional=F
* orig_p: port, log=T, optional=F
* proto: count, log=F, optional=T
* resp_h: addr, log=T, optional=F
* resp_p: port, log=T, optional=F
}
* ip_proto: count, log=T, optional=T
* local_orig: bool, log=T, optional=T
* local_resp: bool, log=T, optional=T
* missed_bytes: count, log=T, optional=T
* orig_bytes: count, log=T, optional=T
* orig_ip_bytes: count, log=T, optional=T
* orig_pkts: count, log=T, optional=T
* proto: enum transport_proto, log=T, optional=F
* resp_bytes: count, log=T, optional=T
* resp_ip_bytes: count, log=T, optional=T
* resp_pkts: count, log=T, optional=T
* service: string, log=T, optional=T
* ts: time, log=T, optional=F
* tunnel_parents: set[string], log=T, optional=T
* uid: string, log=T, optional=F
}
* dce_rpc: record DCE_RPC::Info, log=F, optional=T
DCE_RPC::Info {
* endpoint: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* named_pipe: string, log=T, optional=T
* operation: string, log=T, optional=T
* rtt: interval, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* dce_rpc_backing: table[count] of record DCE_RPC::BackingState, log=F, optional=T
DCE_RPC::BackingState {
* info: record DCE_RPC::Info, log=F, optional=F
DCE_RPC::Info { ... }
* state: record DCE_RPC::State, log=F, optional=F
DCE_RPC::State {
* ctx_to_uuid: table[count] of string, log=F, optional=T
* named_pipe: string, log=F, optional=T
* uuid: string, log=F, optional=T
}
}
* dce_rpc_state: record DCE_RPC::State, log=F, optional=T
DCE_RPC::State { ... }
* dhcp: record DHCP::Info, log=F, optional=T
DHCP::Info {
* assigned_addr: addr, log=T, optional=T
* client_addr: addr, log=T, optional=T
* client_chaddr: string, log=F, optional=T
* client_fqdn: string, log=T, optional=T
* client_message: string, log=T, optional=T
* client_port: port, log=F, optional=T
* domain: string, log=T, optional=T
* duration: interval, log=T, optional=T
* host_name: string, log=T, optional=T
* last_message_ts: time, log=F, optional=T
* lease_time: interval, log=T, optional=T
* mac: string, log=T, optional=T
* msg_types: vector of string, log=T, optional=T
* requested_addr: addr, log=T, optional=T
* server_addr: addr, log=T, optional=T
* server_message: string, log=T, optional=T
* server_port: port, log=F, optional=T
* ts: time, log=T, optional=F
* uids: set[string], log=T, optional=F
}
* dnp3: record DNP3::Info, log=F, optional=T
DNP3::Info {
* fc_reply: string, log=T, optional=T
* fc_request: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* iin: count, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* dns: record DNS::Info, log=F, optional=T
DNS::Info {
* AA: bool, log=T, optional=T
* RA: bool, log=T, optional=T
* RD: bool, log=T, optional=T
* TC: bool, log=T, optional=T
* TTLs: vector of interval, log=T, optional=T
* Z: count, log=T, optional=T
* answers: vector of string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* proto: enum transport_proto, log=T, optional=F
* qclass: count, log=T, optional=T
* qclass_name: string, log=T, optional=T
* qtype: count, log=T, optional=T
* qtype_name: string, log=T, optional=T
* query: string, log=T, optional=T
* rcode: count, log=T, optional=T
* rcode_name: string, log=T, optional=T
* rejected: bool, log=T, optional=T
* rtt: interval, log=T, optional=T
* saw_query: bool, log=F, optional=T
* saw_reply: bool, log=F, optional=T
* total_answers: count, log=F, optional=T
* total_replies: count, log=F, optional=T
* trans_id: count, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* dns_state: record DNS::State, log=F, optional=T
DNS::State {
* pending_queries: table[count] of record Queue::Queue, log=F, optional=T
Queue::Queue {
* bottom: count, log=F, optional=T
* initialized: bool, log=F, optional=T
* settings: record Queue::Settings, log=F, optional=T
Queue::Settings {
* max_len: count, log=F, optional=T
}
* size: count, log=F, optional=T
* top: count, log=F, optional=T
* vals: table[count] of any, log=F, optional=T
}
* pending_query: record DNS::Info, log=F, optional=T
DNS::Info { ... }
* pending_replies: table[count] of record Queue::Queue, log=F, optional=T
Queue::Queue { ... }
}
* duration: interval, log=F, optional=F
* extract_orig: bool, log=F, optional=T
* extract_resp: bool, log=F, optional=T
* ftp: record FTP::Info, log=F, optional=T
FTP::Info {
* arg: string, log=T, optional=T
* capture_password: bool, log=F, optional=T
* cmdarg: record FTP::CmdArg, log=F, optional=T
FTP::CmdArg {
* arg: string, log=F, optional=T
* cmd: string, log=F, optional=T
* cwd_consumed: bool, log=F, optional=T
* seq: count, log=F, optional=T
* ts: time, log=F, optional=F
}
* command: string, log=T, optional=T
* command_seq: count, log=F, optional=T
* cwd: string, log=F, optional=T
* data_channel: record FTP::ExpectedDataChannel, log=T, optional=T
FTP::ExpectedDataChannel {
* orig_h: addr, log=T, optional=F
* passive: bool, log=T, optional=F
* resp_h: addr, log=T, optional=F
* resp_p: port, log=T, optional=F
}
* file_size: count, log=T, optional=T
* fuid: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* last_auth_requested: string, log=F, optional=T
* mime_type: string, log=T, optional=T
* passive: bool, log=F, optional=T
* password: string, log=T, optional=T
* pending_commands: table[count] of record FTP::CmdArg, log=F, optional=F
FTP::CmdArg { ... }
* reply_code: count, log=T, optional=T
* reply_msg: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* user: string, log=T, optional=T
}
* ftp_data_reuse: bool, log=F, optional=T
* history: string, log=F, optional=F
* http: record HTTP::Info, log=F, optional=T
HTTP::Info {
* capture_password: bool, log=F, optional=T
* current_entity: record HTTP::Entity, log=F, optional=T
HTTP::Entity {
* filename: string, log=F, optional=T
}
* host: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* info_code: count, log=T, optional=T
* info_msg: string, log=T, optional=T
* method: string, log=T, optional=T
* orig_filenames: vector of string, log=T, optional=T
* orig_fuids: vector of string, log=T, optional=T
* orig_mime_depth: count, log=F, optional=T
* orig_mime_types: vector of string, log=T, optional=T
* origin: string, log=T, optional=T
* password: string, log=T, optional=T
* proxied: set[string], log=T, optional=T
* range_request: bool, log=F, optional=T
* referrer: string, log=T, optional=T
* request_body_len: count, log=T, optional=T
* resp_filenames: vector of string, log=T, optional=T
* resp_fuids: vector of string, log=T, optional=T
* resp_mime_depth: count, log=F, optional=T
* resp_mime_types: vector of string, log=T, optional=T
* response_body_len: count, log=T, optional=T
* status_code: count, log=T, optional=T
* status_msg: string, log=T, optional=T
* tags: set[enum HTTP::Tags], log=T, optional=F
* trans_depth: count, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* uri: string, log=T, optional=T
* user_agent: string, log=T, optional=T
* username: string, log=T, optional=T
* version: string, log=T, optional=T
}
* http_state: record HTTP::State, log=F, optional=T
HTTP::State {
* current_request: count, log=F, optional=T
* current_response: count, log=F, optional=T
* pending: table[count] of record HTTP::Info, log=F, optional=F
HTTP::Info { ... }
* trans_depth: count, log=F, optional=T
}
* id: record conn_id, log=F, optional=F
conn_id { ... }
* inner_vlan: int, log=F, optional=T
* irc: record IRC::Info, log=F, optional=T
IRC::Info {
* addl: string, log=T, optional=T
* command: string, log=T, optional=T
* dcc_file_name: string, log=T, optional=T
* dcc_file_size: count, log=T, optional=T
* dcc_mime_type: string, log=T, optional=T
* fuid: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* nick: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* user: string, log=T, optional=T
* value: string, log=T, optional=T
}
* krb: record KRB::Info, log=F, optional=T
KRB::Info {
* cipher: string, log=T, optional=T
* client: string, log=T, optional=T
* client_cert: record Files::Info, log=F, optional=T
Files::Info {
* analyzers: set[string], log=T, optional=T
* depth: count, log=T, optional=T
* duration: interval, log=T, optional=T
* extracted: string, log=T, optional=T
* extracted_cutoff: bool, log=T, optional=T
* extracted_size: count, log=T, optional=T
* filename: string, log=T, optional=T
* fuid: string, log=T, optional=F
* id: record conn_id, log=T, optional=T
conn_id { ... }
* is_orig: bool, log=T, optional=T
* local_orig: bool, log=T, optional=T
* md5: string, log=T, optional=T
* mime_type: string, log=T, optional=T
* missing_bytes: count, log=T, optional=T
* overflow_bytes: count, log=T, optional=T
* parent_fuid: string, log=T, optional=T
* seen_bytes: count, log=T, optional=T
* sha1: string, log=T, optional=T
* sha256: string, log=T, optional=T
* source: string, log=T, optional=T
* timedout: bool, log=T, optional=T
* total_bytes: count, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=T
* x509: record X509::Info, log=F, optional=T
X509::Info {
* basic_constraints: record X509::BasicConstraints, log=T, optional=T
X509::BasicConstraints {
* ca: bool, log=T, optional=F
* path_len: count, log=T, optional=T
}
* certificate: record X509::Certificate, log=T, optional=F
X509::Certificate {
* cn: string, log=F, optional=T
* curve: string, log=T, optional=T
* exponent: string, log=T, optional=T
* issuer: string, log=T, optional=F
* key_alg: string, log=T, optional=F
* key_length: count, log=T, optional=T
* key_type: string, log=T, optional=T
* not_valid_after: time, log=T, optional=F
* not_valid_before: time, log=T, optional=F
* serial: string, log=T, optional=F
* sig_alg: string, log=T, optional=F
* subject: string, log=T, optional=F
* tbs_sig_alg: string, log=F, optional=F
* version: count, log=T, optional=F
}
* client_cert: bool, log=T, optional=T
* deduplication_index: record X509::LogCertHash, log=F, optional=T
X509::LogCertHash {
* client_cert: bool, log=F, optional=F
* fingerprint: string, log=F, optional=F
* host_cert: bool, log=F, optional=F
}
* extensions: vector of record X509::Extension, log=F, optional=T
X509::Extension {
* critical: bool, log=F, optional=F
* name: string, log=F, optional=F
* oid: string, log=F, optional=F
* short_name: string, log=F, optional=T
* value: string, log=F, optional=F
}
* extensions_cache: vector of any, log=F, optional=T
* fingerprint: string, log=T, optional=F
* handle: opaque, log=F, optional=F
* host_cert: bool, log=T, optional=T
* san: record X509::SubjectAlternativeName, log=T, optional=T
X509::SubjectAlternativeName {
* dns: vector of string, log=T, optional=T
* email: vector of string, log=T, optional=T
* ip: vector of addr, log=T, optional=T
* other_fields: bool, log=F, optional=F
* uri: vector of string, log=T, optional=T
}
* ts: time, log=T, optional=F
}
}
* client_cert_fuid: string, log=T, optional=T
* client_cert_subject: string, log=T, optional=T
* error_code: count, log=F, optional=T
* error_msg: string, log=T, optional=T
* forwardable: bool, log=T, optional=T
* from: time, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* logged: bool, log=F, optional=T
* renewable: bool, log=T, optional=T
* request_type: string, log=T, optional=T
* server_cert: record Files::Info, log=F, optional=T
Files::Info { ... }
* server_cert_fuid: string, log=T, optional=T
* server_cert_subject: string, log=T, optional=T
* service: string, log=T, optional=T
* success: bool, log=T, optional=T
* till: time, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* ldap: record LDAP::State, log=F, optional=T
LDAP::State {
* messages: table[int] of record LDAP::MessageInfo, log=F, optional=T
LDAP::MessageInfo {
* argument: string, log=T, optional=T
* diagnostic_message: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* message_id: int, log=T, optional=T
* object: string, log=T, optional=T
* opcode: string, log=T, optional=T
* result: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* version: int, log=T, optional=T
}
* searches: table[int] of record LDAP::SearchInfo, log=F, optional=T
LDAP::SearchInfo {
* attributes: vector of string, log=T, optional=T
* base_object: string, log=T, optional=T
* deref_aliases: string, log=T, optional=T
* diagnostic_message: string, log=T, optional=T
* filter: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* message_id: int, log=T, optional=T
* result: string, log=T, optional=T
* result_count: count, log=T, optional=T
* scope: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
}
* modbus: record Modbus::Info, log=F, optional=T
Modbus::Info {
* exception: string, log=T, optional=T
* func: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* pdu_type: string, log=T, optional=T
* tid: count, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* unit: count, log=T, optional=T
}
* mqtt: record MQTT::ConnectInfo, log=F, optional=T
MQTT::ConnectInfo {
* client_id: string, log=T, optional=T
* connect_status: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* proto_name: string, log=T, optional=T
* proto_version: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* will_payload: string, log=T, optional=T
* will_topic: string, log=T, optional=T
}
* mqtt_state: record MQTT::State, log=F, optional=T
MQTT::State {
* publish: table[count] of record MQTT::PublishInfo, log=F, optional=T
MQTT::PublishInfo {
* ack: bool, log=F, optional=T
* comp: bool, log=F, optional=T
* from_client: bool, log=T, optional=F
* id: record conn_id, log=T, optional=F
conn_id { ... }
* payload: string, log=T, optional=F
* payload_len: count, log=T, optional=F
* qos: string, log=T, optional=F
* qos_level: count, log=F, optional=T
* rec: bool, log=F, optional=T
* rel: bool, log=F, optional=T
* retain: bool, log=T, optional=F
* status: string, log=T, optional=T
* topic: string, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* subscribe: table[count] of record MQTT::SubscribeInfo, log=F, optional=T
MQTT::SubscribeInfo {
* ack: bool, log=T, optional=T
* action: enum MQTT::SubUnsub, log=T, optional=F
* granted_qos_level: count, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* qos_levels: vector of count, log=T, optional=T
* topics: vector of string, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
}
* mysql: record MySQL::Info, log=F, optional=T
MySQL::Info {
* arg: string, log=T, optional=F
* cmd: string, log=T, optional=F
* id: record conn_id, log=T, optional=F
conn_id { ... }
* response: string, log=T, optional=T
* rows: count, log=T, optional=T
* success: bool, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* ntlm: record NTLM::Info, log=F, optional=T
NTLM::Info {
* domainname: string, log=T, optional=T
* done: bool, log=F, optional=T
* hostname: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* server_dns_computer_name: string, log=T, optional=T
* server_nb_computer_name: string, log=T, optional=T
* server_tree_name: string, log=T, optional=T
* success: bool, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* username: string, log=T, optional=T
}
* ntp: record NTP::Info, log=F, optional=T
NTP::Info {
* id: record conn_id, log=T, optional=F
conn_id { ... }
* mode: count, log=T, optional=F
* num_exts: count, log=T, optional=T
* org_time: time, log=T, optional=F
* poll: interval, log=T, optional=F
* precision: interval, log=T, optional=F
* rec_time: time, log=T, optional=F
* ref_id: string, log=T, optional=F
* ref_time: time, log=T, optional=F
* root_delay: interval, log=T, optional=F
* root_disp: interval, log=T, optional=F
* stratum: count, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* version: count, log=T, optional=F
* xmt_time: time, log=T, optional=F
}
* orig: record endpoint, log=F, optional=F
endpoint {
* flow_label: count, log=F, optional=F
* l2_addr: string, log=F, optional=T
* num_bytes_ip: count, log=F, optional=T
* num_pkts: count, log=F, optional=T
* size: count, log=F, optional=F
* state: count, log=F, optional=F
}
* postgresql: record PostgreSQL::Info, log=F, optional=T
PostgreSQL::Info {
* application_name: string, log=T, optional=T
* backend: string, log=T, optional=T
* backend_arg: string, log=T, optional=T
* database: string, log=T, optional=T
* frontend: string, log=T, optional=T
* frontend_arg: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* rows: count, log=T, optional=T
* success: bool, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* user: string, log=T, optional=T
}
* postgresql_state: record PostgreSQL::State, log=F, optional=T
PostgreSQL::State {
* application_name: string, log=F, optional=T
* database: string, log=F, optional=T
* errors: vector of string, log=F, optional=F
* rows: count, log=F, optional=T
* user: string, log=F, optional=T
* version: record PostgreSQL::Version, log=F, optional=T
PostgreSQL::Version {
* major: count, log=F, optional=F
* minor: count, log=F, optional=F
}
}
* quic: record QUIC::Info, log=F, optional=T
QUIC::Info {
* client_initial_dcid: string, log=T, optional=T
* client_protocol: string, log=T, optional=T
* client_scid: string, log=T, optional=T
* history: string, log=T, optional=T
* history_state: vector of string, log=F, optional=F
* id: record conn_id, log=T, optional=F
conn_id { ... }
* logged: bool, log=F, optional=T
* server_name: string, log=T, optional=T
* server_scid: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* version: string, log=T, optional=F
}
* radius: record RADIUS::Info, log=F, optional=T
RADIUS::Info {
* connect_info: string, log=T, optional=T
* framed_addr: addr, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* logged: bool, log=F, optional=T
* mac: string, log=T, optional=T
* reply_msg: string, log=T, optional=T
* result: string, log=T, optional=T
* ts: time, log=T, optional=F
* ttl: interval, log=T, optional=T
* tunnel_client: string, log=T, optional=T
* uid: string, log=T, optional=F
* username: string, log=T, optional=T
}
* rdp: record RDP::Info, log=F, optional=T
RDP::Info {
* analyzer_id: count, log=F, optional=T
* cert_count: count, log=T, optional=T
* cert_permanent: bool, log=T, optional=T
* cert_type: string, log=T, optional=T
* client_build: string, log=T, optional=T
* client_channels: vector of string, log=T, optional=T
* client_dig_product_id: string, log=T, optional=T
* client_name: string, log=T, optional=T
* cookie: string, log=T, optional=T
* desktop_height: count, log=T, optional=T
* desktop_width: count, log=T, optional=T
* done: bool, log=F, optional=T
* encryption_level: string, log=T, optional=T
* encryption_method: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* keyboard_layout: string, log=T, optional=T
* requested_color_depth: string, log=T, optional=T
* result: string, log=T, optional=T
* security_protocol: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* redis: record Redis::Info, log=F, optional=T
Redis::Info {
* cmd: record Redis::Command, log=T, optional=F
Redis::Command {
* key: string, log=T, optional=T
* known: enum Redis::KnownCommand, log=F, optional=T
* name: string, log=T, optional=F
* raw: vector of string, log=F, optional=F
* value: string, log=T, optional=T
}
* id: record conn_id, log=T, optional=F
conn_id { ... }
* reply: record Redis::ReplyData, log=T, optional=T
Redis::ReplyData {
* value: string, log=T, optional=T
}
* success: bool, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* redis_state: record Redis::State, log=F, optional=T
Redis::State {
* current_command: count, log=F, optional=T
* current_reply: count, log=F, optional=T
* no_reply_ranges: vector of record Redis::NoReplyRange, log=F, optional=F
Redis::NoReplyRange {
* begin: count, log=F, optional=F
* end: count, log=F, optional=T
}
* pending: table[count] of record Redis::Info, log=F, optional=F
Redis::Info { ... }
* violation: bool, log=F, optional=T
}
* removal_hooks: set[func], log=F, optional=T
* resp: record endpoint, log=F, optional=F
endpoint { ... }
* rfb: record RFB::Info, log=F, optional=T
RFB::Info {
* auth: bool, log=T, optional=T
* authentication_method: string, log=T, optional=T
* client_major_version: string, log=T, optional=T
* client_minor_version: string, log=T, optional=T
* desktop_name: string, log=T, optional=T
* done: bool, log=F, optional=T
* height: count, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* server_major_version: string, log=T, optional=T
* server_minor_version: string, log=T, optional=T
* share_flag: bool, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* width: count, log=T, optional=T
}
* service: set[string], log=F, optional=F
* service_violation: set[string], log=F, optional=T
* sip: record SIP::Info, log=F, optional=T
SIP::Info {
* call_id: string, log=T, optional=T
* content_type: string, log=T, optional=T
* date: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* method: string, log=T, optional=T
* reply_to: string, log=T, optional=T
* request_body_len: count, log=T, optional=T
* request_from: string, log=T, optional=T
* request_path: vector of string, log=T, optional=T
* request_to: string, log=T, optional=T
* response_body_len: count, log=T, optional=T
* response_from: string, log=T, optional=T
* response_path: vector of string, log=T, optional=T
* response_to: string, log=T, optional=T
* seq: string, log=T, optional=T
* status_code: count, log=T, optional=T
* status_msg: string, log=T, optional=T
* subject: string, log=T, optional=T
* trans_depth: count, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* uri: string, log=T, optional=T
* user_agent: string, log=T, optional=T
* warning: string, log=T, optional=T
}
* sip_state: record SIP::State, log=F, optional=T
SIP::State {
* current_request: count, log=F, optional=T
* current_response: count, log=F, optional=T
* pending: table[count] of record SIP::Info, log=F, optional=F
SIP::Info { ... }
}
* smb_state: record SMB::State, log=F, optional=T
SMB::State {
* current_cmd: record SMB::CmdInfo, log=F, optional=T
SMB::CmdInfo {
* argument: string, log=T, optional=T
* command: string, log=T, optional=F
* id: record conn_id, log=T, optional=F
conn_id { ... }
* referenced_file: record SMB::FileInfo, log=T, optional=T
SMB::FileInfo {
* action: enum SMB::Action, log=T, optional=T
* fid: count, log=F, optional=T
* fuid: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* name: string, log=T, optional=T
* path: string, log=T, optional=T
* prev_name: string, log=T, optional=T
* size: count, log=T, optional=T
* times: record SMB::MACTimes, log=T, optional=T
SMB::MACTimes {
* accessed: time, log=T, optional=F
* accessed_raw: count, log=F, optional=F
* changed: time, log=T, optional=F
* changed_raw: count, log=F, optional=F
* created: time, log=T, optional=F
* created_raw: count, log=F, optional=F
* modified: time, log=T, optional=F
* modified_raw: count, log=F, optional=F
}
* ts: time, log=T, optional=T
* uid: string, log=T, optional=F
* uuid: string, log=F, optional=T
}
* referenced_tree: record SMB::TreeInfo, log=F, optional=T
SMB::TreeInfo {
* id: record conn_id, log=T, optional=F
conn_id { ... }
* native_file_system: string, log=T, optional=T
* path: string, log=T, optional=T
* service: string, log=T, optional=T
* share_type: string, log=T, optional=T
* ts: time, log=T, optional=T
* uid: string, log=T, optional=F
}
* rtt: interval, log=T, optional=T
* smb1_offered_dialects: vector of string, log=F, optional=T
* smb2_create_options: count, log=F, optional=T
* smb2_offered_dialects: vector of count, log=F, optional=T
* status: string, log=T, optional=T
* sub_command: string, log=T, optional=T
* tree: string, log=T, optional=T
* tree_service: string, log=T, optional=T
* ts: time, log=T, optional=T
* uid: string, log=T, optional=F
* username: string, log=T, optional=T
* version: string, log=T, optional=F
}
* current_file: record SMB::FileInfo, log=F, optional=T
SMB::FileInfo { ... }
* current_tree: record SMB::TreeInfo, log=F, optional=T
SMB::TreeInfo { ... }
* fid_map: table[count] of record SMB::FileInfo, log=F, optional=T
SMB::FileInfo { ... }
* pending_cmds: table[count] of record SMB::CmdInfo, log=F, optional=T
SMB::CmdInfo { ... }
* pipe_map: table[count] of string, log=F, optional=T
* recent_files: set[string], log=F, optional=T
* tid_map: table[count] of record SMB::TreeInfo, log=F, optional=T
SMB::TreeInfo { ... }
}
* smtp: record SMTP::Info, log=F, optional=T
SMTP::Info {
* cc: set[string], log=T, optional=T
* date: string, log=T, optional=T
* entity: record SMTP::Entity, log=F, optional=T
SMTP::Entity {
* filename: string, log=F, optional=T
}
* entity_count: count, log=F, optional=T
* first_received: string, log=T, optional=T
* from: string, log=T, optional=T
* fuids: vector of string, log=T, optional=T
* has_client_activity: bool, log=F, optional=T
* helo: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* in_reply_to: string, log=T, optional=T
* last_reply: string, log=T, optional=T
* mailfrom: string, log=T, optional=T
* msg_id: string, log=T, optional=T
* path: vector of addr, log=T, optional=T
* process_received_from: bool, log=F, optional=T
* process_smtp_headers: bool, log=F, optional=T
* rcptto: set[string], log=T, optional=T
* reply_to: string, log=T, optional=T
* second_received: string, log=T, optional=T
* subject: string, log=T, optional=T
* tls: bool, log=T, optional=T
* to: set[string], log=T, optional=T
* trans_depth: count, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* user_agent: string, log=T, optional=T
* x_originating_ip: addr, log=T, optional=T
}
* smtp_state: record SMTP::State, log=F, optional=T
SMTP::State {
* analyzer_id: count, log=F, optional=T
* helo: string, log=F, optional=T
* invalid_transactions: count, log=F, optional=T
* messages_transferred: count, log=F, optional=T
* mime_depth: count, log=F, optional=T
* pending_messages: set[record SMTP::Info], log=F, optional=T
SMTP::Info] {
}
* trans_mail_from_seen: bool, log=F, optional=T
* trans_rcpt_to_seen: bool, log=F, optional=T
}
* snmp: record SNMP::Info, log=F, optional=T
SNMP::Info {
* community: string, log=T, optional=T
* display_string: string, log=T, optional=T
* duration: interval, log=T, optional=T
* get_bulk_requests: count, log=T, optional=T
* get_requests: count, log=T, optional=T
* get_responses: count, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* set_requests: count, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* up_since: time, log=T, optional=T
* version: string, log=T, optional=F
}
* socks: record SOCKS::Info, log=F, optional=T
SOCKS::Info {
* bound: record SOCKS::Address, log=T, optional=T
SOCKS::Address {
* host: addr, log=T, optional=T
* name: string, log=T, optional=T
}
* bound_p: port, log=T, optional=T
* capture_password: bool, log=F, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* password: string, log=T, optional=T
* request: record SOCKS::Address, log=T, optional=T
SOCKS::Address { ... }
* request_p: port, log=T, optional=T
* status: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* user: string, log=T, optional=T
* version: count, log=T, optional=F
}
* ssh: record SSH::Info, log=F, optional=T
SSH::Info {
* analyzer_id: count, log=F, optional=T
* auth_attempts: count, log=T, optional=T
* auth_success: bool, log=T, optional=T
* capabilities: record SSH::Capabilities, log=F, optional=T
SSH::Capabilities {
* compression_algorithms: record SSH::Algorithm_Prefs, log=F, optional=F
SSH::Algorithm_Prefs {
* client_to_server: vector of string, log=F, optional=T
* server_to_client: vector of string, log=F, optional=T
}
* encryption_algorithms: record SSH::Algorithm_Prefs, log=F, optional=F
SSH::Algorithm_Prefs { ... }
* is_server: bool, log=F, optional=F
* kex_algorithms: vector of string, log=F, optional=F
* languages: record SSH::Algorithm_Prefs, log=F, optional=T
SSH::Algorithm_Prefs { ... }
* mac_algorithms: record SSH::Algorithm_Prefs, log=F, optional=F
SSH::Algorithm_Prefs { ... }
* server_host_key_algorithms: vector of string, log=F, optional=F
}
* cipher_alg: string, log=T, optional=T
* client: string, log=T, optional=T
* compression_alg: string, log=T, optional=T
* direction: enum Direction, log=T, optional=T
* host_key: string, log=T, optional=T
* host_key_alg: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* kex_alg: string, log=T, optional=T
* logged: bool, log=F, optional=T
* mac_alg: string, log=T, optional=T
* server: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* version: count, log=T, optional=T
}
* ssl: record SSL::Info, log=F, optional=T
SSL::Info {
* analyzer_id: count, log=F, optional=T
* cert_chain: vector of record Files::Info, log=F, optional=T
Files::Info { ... }
* cert_chain_fps: vector of string, log=T, optional=T
* cipher: string, log=T, optional=T
* client_cert_chain: vector of record Files::Info, log=F, optional=T
Files::Info { ... }
* client_cert_chain_fps: vector of string, log=T, optional=T
* client_depth: count, log=F, optional=T
* client_issuer: string, log=T, optional=T
* client_key_exchange_seen: bool, log=F, optional=T
* client_psk_seen: bool, log=F, optional=T
* client_subject: string, log=T, optional=T
* client_ticket_empty_session_seen: bool, log=F, optional=T
* curve: string, log=T, optional=T
* delay_tokens: set[string], log=F, optional=T
* established: bool, log=T, optional=T
* hrr_seen: bool, log=F, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* issuer: string, log=T, optional=T
* last_alert: string, log=T, optional=T
* logged: bool, log=F, optional=T
* next_protocol: string, log=T, optional=T
* resumed: bool, log=T, optional=T
* server_depth: count, log=F, optional=T
* server_name: string, log=T, optional=T
* session_id: string, log=F, optional=T
* sni_matches_cert: bool, log=T, optional=T
* ssl_history: string, log=T, optional=T
* subject: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* version: string, log=T, optional=T
* version_num: count, log=F, optional=T
}
* start_time: time, log=F, optional=F
* syslog: record Syslog::Info, log=F, optional=T
Syslog::Info {
* facility: string, log=T, optional=F
* id: record conn_id, log=T, optional=F
conn_id { ... }
* message: string, log=T, optional=F
* proto: enum transport_proto, log=T, optional=F
* severity: string, log=T, optional=F
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
}
* thresholds: record ConnThreshold::Thresholds, log=F, optional=T
ConnThreshold::Thresholds {
* duration: set[interval], log=F, optional=T
* orig_byte: set[count], log=F, optional=T
* orig_packet: set[count], log=F, optional=T
* resp_byte: set[count], log=F, optional=T
* resp_packet: set[count], log=F, optional=T
}
* tunnel: vector of record Tunnel::EncapsulatingConn, log=F, optional=T
Tunnel::EncapsulatingConn {
* cid: record conn_id, log=T, optional=F
conn_id { ... }
* tunnel_type: enum Tunnel::Type, log=T, optional=F
* uid: string, log=T, optional=T
}
* uid: string, log=F, optional=F
* vlan: int, log=F, optional=T
* websocket: record WebSocket::Info, log=F, optional=T
WebSocket::Info {
* client_extensions: vector of string, log=T, optional=T
* client_key: string, log=F, optional=T
* client_protocols: vector of string, log=T, optional=T
* host: string, log=T, optional=T
* id: record conn_id, log=T, optional=F
conn_id { ... }
* server_accept: string, log=F, optional=T
* server_extensions: vector of string, log=T, optional=T
* subprotocol: string, log=T, optional=T
* ts: time, log=T, optional=F
* uid: string, log=T, optional=F
* uri: string, log=T, optional=T
* user_agent: string, log=T, optional=T
}
}
Reference in a new issue View git blame Copy permalink