mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 16:18:19 +00:00
ded98cd373
This is based on commit 2731def9159247e6da8a3191783c89683363689c from the zeek-docs repo.
46 lines
1.9 KiB
ReStructuredText
46 lines
1.9 KiB
ReStructuredText
:tocdepth: 3
|
|
|
|
policy/frameworks/intel/seen/manage-event-groups.zeek
|
|
=====================================================
|
|
.. zeek:namespace:: Intel
|
|
|
|
|
|
:Namespace: Intel
|
|
:Imports: :doc:`base/frameworks/reporter </scripts/base/frameworks/reporter/index>`, :doc:`policy/frameworks/intel/seen </scripts/policy/frameworks/intel/seen/index>`
|
|
|
|
Summary
|
|
~~~~~~~
|
|
Redefinable Options
|
|
###################
|
|
================================================================================= ============================================================
|
|
:zeek:id:`Intel::manage_seen_event_groups`: :zeek:type:`bool` :zeek:attr:`&redef` Whether Intel event groups for the seen scripts are managed.
|
|
================================================================================= ============================================================
|
|
|
|
|
|
Detailed Interface
|
|
~~~~~~~~~~~~~~~~~~
|
|
Redefinable Options
|
|
###################
|
|
.. zeek:id:: Intel::manage_seen_event_groups
|
|
:source-code: policy/frameworks/intel/seen/manage-event-groups.zeek 21 21
|
|
|
|
:Type: :zeek:type:`bool`
|
|
:Attributes: :zeek:attr:`&redef`
|
|
:Default: ``T``
|
|
|
|
Whether Intel event groups for the seen scripts are managed.
|
|
|
|
When loading this script, by default, all :zeek:see:`Intel::Type`
|
|
event groups are disabled at startup and only enabled when indicators
|
|
of corresponding types are loaded into the Intel framework's store.
|
|
This allows to load the ``frameworks/intel/seen`` scripts without
|
|
incurring event handling overhead when no Intel indicators are loaded.
|
|
|
|
One caveat is that the :zeek:see:`Intel::seen_policy` hook will not
|
|
be invoked for indicator types that are not at all in the Intel
|
|
framework's store. If you rely on :zeek:see:`Intel::seen_policy` to
|
|
find unmatched indicators, do not not load this script, set this
|
|
variable to ``F``, or insert dummy values of the types using
|
|
:zeek:see:`Intel::insert`.
|
|
|
|
|