mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
f56785740c
The user and password fields are replicated to each of the ftp.log entries. Using a very large username (100s of KBs) allows to bloat the log without actually sending much traffic. Further, limit the arg and reply_msg columns to large, but not unbounded values. |
||
|---|---|---|
| .. | ||
| actions | ||
| __load__.zeek | ||
| main.zeek | ||
| README | ||
| weird.zeek | ||
The notice framework enables Zeek to "notice" things which are odd or potentially bad, leaving it to the local configuration to define which of them are actionable. This decoupling of detection and reporting allows Zeek to be customized to the different needs that sites have.