zeek/scripts
Johanna Amann 8ce746cc25 Merge remote-tracking branch 'origin/topic/vladg/bit-1641'
* origin/topic/vladg/bit-1641:
  Logic fix for ssh/main.bro when the auth status is indeterminate, and fix a test. Addresses BIT-1641.
  Clean up the logic for ssh_auth_failed. Addresses BIT-1641
  Update baselines for adding a field to ssh.log as part of BIT-1641
  Script-land changes for BIT-1641.
  Change SSH.cc to use ssh_auth_attempted instead of ssh_auth_failed. Addresses BIT-1641.
  Revert "Fixing duplicate SSH authentication failure events."
  Create new SSH events ssh_auth_attempt and ssh_auth_result. Add auth_attempts to SSH::Info. Address BIT-1641.

I extended the tests a bit and did some small cleanups. I also moved the
SSH events back to the global namespace for backwards compatibility and
for consistency (the way it was at the moment, some of them were global
some SSH::).

Furthermore, I fixed the ssh_auth_result result event, it was only
raised in the success case. ssh_auth_result is now also checked in the
testcases. I also have a suspicion that the intel integration never
really worked before.

BIT-1641 #merged
2016-10-18 21:57:27 -04:00
..
base Merge remote-tracking branch 'origin/topic/vladg/bit-1641' 2016-10-18 21:57:27 -04:00
broxygen Fix Broxygen coverage. 2015-03-13 14:53:11 -05:00
policy Merge remote-tracking branch 'origin/topic/vladg/bit-1641' 2016-10-18 21:57:27 -04:00
site update scripts loaded by default in local.bro. 2016-08-10 08:57:22 -07:00
CMakeLists.txt Don't install test-all-policy.bro script as it's for testing only. 2011-10-12 12:42:12 -05:00
test-all-policy.bro Merge remote-tracking branch 'origin/master' into topic/seth/smb 2016-08-08 15:46:49 -04:00