mirror of
https://github.com/zeek/zeek.git
synced 2025-10-12 03:28:19 +00:00
6d19c49efe
The seen/file-names script relies on f$info$filename to be populated. For HTTP and other network protocols, however, this field is only populated during file_over_new_connection() that's running after file_new(). Use the file_new() event only for files without connections and file_over_new_connection() implies that f$conns is populated, anyway. Special case SMB to avoid finding files twice, because there's a custom implementation in seen/smb-filenames.zeek. Fixes #2647 |
||
|---|---|---|
| .. | ||
| __load__.zeek | ||
| conn-established.zeek | ||
| dns.zeek | ||
| file-hashes.zeek | ||
| file-names.zeek | ||
| http-headers.zeek | ||
| http-url.zeek | ||
| pubkey-hashes.zeek | ||
| README | ||
| smb-filenames.zeek | ||
| smtp-url-extraction.zeek | ||
| smtp.zeek | ||
| ssl.zeek | ||
| where-locations.zeek | ||
| x509.zeek | ||
Scripts that send data to the intelligence framework.