Jon Siwek 35827eeb31 Add rate-limiting sampling mechanism for weird events ... The generation of weird events, by default, are now rate-limited according to these tunable options: - Weird::sampling_whitelist - Weird::sampling_threshold - Weird::sampling_rate - Weird::sampling_duration The new get_reporter_stats() BIF also allows one to query the total number of weirds generated (pre-sampling) which the new policy/misc/weird-stats.bro script uses periodically to populate a weird_stats.log. There's also new reporter BIFs to allow generating weirds from the script-layer such that they go through the same, internal rate-limiting/sampling mechanisms: - Reporter::conn_weird - Reporter::flow_weird - Reporter::net_weird Some of the code was adapted from previous work by Johanna Amann.		2018-07-26 19:57:36 -05:00
..
base	Add rate-limiting sampling mechanism for weird events	2018-07-26 19:57:36 -05:00
broxygen	Merge topic/actor-system throug a squashed commit.	2018-05-18 22:39:23 +00:00
policy	Add rate-limiting sampling mechanism for weird events	2018-07-26 19:57:36 -05:00
site	Fix for BIT-1927: notice/extend-email relocation	2018-05-10 09:13:52 -04:00
CMakeLists.txt	Add a new site policy script local-logger.bro	2016-10-31 20:43:50 -05:00
test-all-policy.bro	Add rate-limiting sampling mechanism for weird events	2018-07-26 19:57:36 -05:00