mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 01:58:20 +00:00
32f1c736f7
- policy/frameworks/intel/seen is the new location for the scripts
that push data into the intel framework for checking.
- The new policy/frameworks/intel/do_notice script adds an example
mechanism for data driven notices.
25 lines
484 B
Text
25 lines
484 B
Text
@load base/frameworks/intel
|
|
|
|
export {
|
|
redef enum Intel::Where += {
|
|
Conn::IN_ORIG,
|
|
Conn::IN_RESP,
|
|
DNS::IN_REQUEST,
|
|
DNS::IN_RESPONSE,
|
|
HTTP::IN_HOST_HEADER,
|
|
HTTP::IN_USER_AGENT_HEADER,
|
|
HTTP::IN_URL,
|
|
SMTP::IN_MAIL_FROM,
|
|
SMTP::IN_RCPT_TO,
|
|
SMTP::IN_FROM,
|
|
SMTP::IN_TO,
|
|
SMTP::IN_RECEIVED_HEADER,
|
|
SMTP::IN_REPLY_TO,
|
|
SMTP::IN_X_ORIGINATING_IP_HEADER,
|
|
SMTP::IN_MESSAGE,
|
|
SSL::IN_SERVER_CERT,
|
|
SSL::IN_CLIENT_CERT,
|
|
SSL::IN_SERVER_NAME,
|
|
SMTP::IN_HEADER,
|
|
};
|
|
}
|