mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 07:08:19 +00:00
32f1c736f7
- policy/frameworks/intel/seen is the new location for the scripts
that push data into the intel framework for checking.
- The new policy/frameworks/intel/do_notice script adds an example
mechanism for data driven notices.
12 lines
326 B
Text
12 lines
326 B
Text
@load base/frameworks/intel
|
|
@load ./where-locations
|
|
|
|
event connection_established(c: connection)
|
|
{
|
|
if ( c$orig$state == TCP_ESTABLISHED &&
|
|
c$resp$state == TCP_ESTABLISHED )
|
|
{
|
|
Intel::seen([$host=c$id$orig_h, $conn=c, $where=Conn::IN_ORIG]);
|
|
Intel::seen([$host=c$id$resp_h, $conn=c, $where=Conn::IN_RESP]);
|
|
}
|
|
}
|