mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
34 lines
1.3 KiB
JavaScript
34 lines
1.3 KiB
JavaScript
/*
|
|
* @TEST-DOC: Load intel data from a JSON file and populate via Intel::insert().
|
|
* @TEST-REQUIRES: $SCRIPTS/have-javascript
|
|
* @TEST-EXEC: zeek -b -Cr $TRACES/http/get.trace frameworks/intel/seen base/frameworks/intel base/protocols/http %INPUT
|
|
* @TEST-EXEC: zeek-cut < intel.log > intel.log.noheader
|
|
* @TEST-EXEC: TEST_DIFF_CANONIFIER= btest-diff intel.log.noheader
|
|
*
|
|
*/
|
|
|
|
// Following the intel file that we load via Intel::insert().
|
|
// @TEST-START-FILE intel.json_lines
|
|
{"indicator": "141.142.228.5", "indicator_type": "Intel::ADDR", "meta": {"source": "json1"}}
|
|
{"indicator": "bro.org", "indicator_type": "Intel::DOMAIN", "meta": {"source": "json2"}}
|
|
// @TEST-END-FILE
|
|
const fs = require('fs');
|
|
|
|
zeek.on('zeek_init', () => {
|
|
// Hold the packet processing until we've read the intel file.
|
|
zeek.invoke('suspend_processing');
|
|
|
|
// This reads the full file into memory, but is still async.
|
|
// There's fs.createReadStream() for the piecewise consumption.
|
|
fs.readFile('./intel.json_lines', 'utf8', (err, data) => {
|
|
for (const l of data.split('\n')) {
|
|
if (l.length == 0)
|
|
continue;
|
|
|
|
zeek.invoke('Intel::insert', [JSON.parse(l)]);
|
|
}
|
|
|
|
/* Once all intel data is loaded, continue processing. */
|
|
zeek.invoke('continue_processing');
|
|
});
|
|
});
|