Jon Siwek 35827eeb31 Add rate-limiting sampling mechanism for weird events ... The generation of weird events, by default, are now rate-limited according to these tunable options: - Weird::sampling_whitelist - Weird::sampling_threshold - Weird::sampling_rate - Weird::sampling_duration The new get_reporter_stats() BIF also allows one to query the total number of weirds generated (pre-sampling) which the new policy/misc/weird-stats.bro script uses periodically to populate a weird_stats.log. There's also new reporter BIFs to allow generating weirds from the script-layer such that they go through the same, internal rate-limiting/sampling mechanisms: - Reporter::conn_weird - Reporter::flow_weird - Reporter::net_weird Some of the code was adapted from previous work by Johanna Amann.		2018-07-26 19:57:36 -05:00
..
base	Add serialization group to clustered config framework tests.	2018-07-24 01:39:39 +00:00
policy	Add rate-limiting sampling mechanism for weird events	2018-07-26 19:57:36 -05:00
site	Update local-compat test for 2.5	2016-08-17 10:38:18 -07:00
check-test-all-policy.bro	Reorganizing btest/policy directory to match new scripts/ organization	2011-08-11 10:43:11 -05:00