mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 09:38:19 +00:00
979d43eac0
Catch-and-release logs now include the plugin that is responsible for an action. Furthermore, the catch-and-release log also includes instances where a rule already existed, and where an error occurred during an operation.
16 lines
1.4 KiB
Text
16 lines
1.4 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path netcontrol_catch_release
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts rule_id ip action block_interval watch_interval blocked_until watched_until num_blocked location message plugin
|
|
#types time string addr enum interval interval time time count string string string
|
|
XXXXXXXXXX.XXXXXX 2 192.168.18.50 NetControl::ADDED 600.000000 3600.000000 - XXXXXXXXXX.XXXXXX 1 test drop Address already blocked outside of catch-and-release. Catch and release will monitor and only actively block if it appears in network traffic. -
|
|
XXXXXXXXXX.XXXXXX 2 192.168.18.50 NetControl::DROPPED 600.000000 3600.000000 - XXXXXXXXXX.XXXXXX 1 test drop - Debug-All
|
|
XXXXXXXXXX.XXXXXX 3 192.168.18.50 NetControl::SEEN_AGAIN 3600.000000 86400.000000 XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX 2 test drop - -
|
|
XXXXXXXXXX.XXXXXX 3 192.168.18.50 NetControl::DROPPED 3600.000000 86400.000000 XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX 2 test drop - Debug-All
|
|
XXXXXXXXXX.XXXXXX 4 192.168.18.50 NetControl::SEEN_AGAIN 86400.000000 604800.000000 XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX 3 test drop - -
|
|
XXXXXXXXXX.XXXXXX 4 192.168.18.50 NetControl::DROPPED 86400.000000 604800.000000 XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX 3 test drop - Debug-All
|
|
#close XXXX-XX-XX-XX-XX-XX
|