zeek/policy/http/headers.bro
2011-04-20 08:53:22 -04:00

17 lines
No EOL
352 B
Text

##! Extract and include the headers used for each request in the log.
@load http/base
module HTTP;
redef record State += {
headers: vector of string &log &default=vector("");
};
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=4
{
if ( ! is_orig )
return;
c$http$headers[|c$http$headers|+1] = name;
}