mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 15:18:20 +00:00
3ac877e20d
This is similar to what the external corelight/zeek-smb-clear-state script does, but leverages the smb2_discarded_messages_state() event instead of regularly checking on the state of SMB connections. The pcap was created using the dperson/samba container image and mounting a share with Linux's CIFS filesystem, then copying the content of a directory with 100 files. The test uses a BPF filter to imitate mostly "half-duplex" traffic. |
||
|---|---|---|
| .. | ||
| actions | ||
| __load__.zeek | ||
| main.zeek | ||
| README | ||
| weird.zeek | ||
The notice framework enables Zeek to "notice" things which are odd or potentially bad, leaving it to the local configuration to define which of them are actionable. This decoupling of detection and reporting allows Zeek to be customized to the different needs that sites have.