mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
110d9fbd6a
work fine now. Todo: * update all baselines * fix the circular reference to the fa_file structure I introduced :) Sadly this does not seem to be entirely straightforward. addresses BIT-953, BIT-760
13 lines
417 B
Text
13 lines
417 B
Text
@load base/frameworks/intel
|
|
@load base/protocols/ssl
|
|
@load ./where-locations
|
|
|
|
event ssl_extension(c: connection, is_orig: bool, code: count, val: string)
|
|
{
|
|
if ( is_orig && SSL::extensions[code] == "server_name" &&
|
|
c?$ssl && c$ssl?$server_name )
|
|
Intel::seen([$indicator=c$ssl$server_name,
|
|
$indicator_type=Intel::DOMAIN,
|
|
$conn=c,
|
|
$where=SSL::IN_SERVER_NAME]);
|
|
}
|