zeek/scripts
Justin Azoff e8de3de2d4 Optimize software found cluster communication
As a followup to 3bf8c8ceb6 that added the
parse cache, add a small short lived cache on the workers to effectively
debounce the number of Software::new events sent up to the proxies.

User-Agents are highly repetitive, workers often see exact duplicate
user-agents on the same orig_h. Worse, due to NAT, virtualization, and
the proliferation of Electron based applications, variations of the same
user-agent can be seen at the same time.  For example:

	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.18 Safari/537.36 Zoom/6.2.0 (1855)

When these two user-agents are seen concurrently, the software framework
will log each flip as a new user-agent. This can be fixed separately on
the proxy side, but a reduction of Software::new events is still needed
to reduce cluster communication overhead as well as the load on the
proxies.

With a 10 minute cache on the workers, this should greatly reduce the
number of redundant user-agents logged in the software.log
2025-05-02 10:14:19 -04:00
..
base Optimize software found cluster communication 2025-05-02 10:14:19 -04:00
policy Merge branch 'topic/mohan/intel-event-groups' of https://github.com/Mohan-Dhawan/zeek 2025-04-29 15:00:58 +02:00
site telemetry: Deprecate prometheus.zeek policy script 2024-07-21 17:49:21 +02:00
spicy Spicy: Document lifetime semantics of Zeek analyzers created from Spicy. 2025-04-10 12:17:05 +02:00
zeekygen zeekygen: Disable Cluster::Experimental module 2024-12-13 10:03:44 +01:00
CMakeLists.txt Use the same rules as cmake submodule to reformat Zeek 2023-05-09 08:31:43 -07:00
test-all-policy.zeek Redis: Add new backend 2025-03-18 09:32:34 -07:00