dns-ext.bro @@ -5,11 +5,32 @@ function numeric_id_string(id: conn_id): string id$resp_h, id$resp_p); } +function fmt_addr_set(input: addr_set): string + { + local output = ""; + local tmp = ""; + local len = length(input); + local i = 1; + + for ( item in input ) + { + tmp = fmt("%s", item); + if ( len != i ) + tmp = fmt("%s ", tmp); + i = i+1; + output = fmt("%s%s", output, tmp); + } + return fmt("%s", output); + } + function fmt_str_set(input: string_set, strip: pattern): string { + local len = length(input); + if ( len == 0 ) + return "{}"; + local output = "{"; local tmp = ""; - local len = length(input); local i = 1; for ( item in input ) functions-ext.bro @@ -1,4 +1,9 @@ @load site @load functions-ext -const private_address_space: set[subnet] = {10.0.0.0/8, 192.168.0.0/16, 127.0.0.0/8, 172.16.0.0/12}; \ No newline at end of file +const private_address_space: set[subnet] = {10.0.0.0/8, 192.168.0.0/16, 127.0.0.0/8, 172.16.0.0/12}; + +# This defines the event that is used by the bro-dblogger application +# to push data from Bro directly into a database. +# see: http://github.com/sethhall/bro-dblogger/tree/master +global db_log: event(db_table: string, data: any); global-ext.bro @@ -32,7 +32,7 @@ export { &expire_func=expire_md5_sum &redef; - # These are the file types that are index in the MHR. + # These are the file types that are indexed in the MHR. const executable_mime = /application\/x-dosexec/ # Windows and DOS executables | /application\/x-executable/ &redef; # *NIX executable binary md5_hash_malware/http-cymru-malware-hash.bro @@ -46,6 +46,7 @@ export { | /psbl\.surriel\.com\// | /antispam\.imp\.ch\// | /dyndns\.com\/.*spam/ + | /rbl\.knology\.net\// | /intercept\.datapacket\.net\// &redef; } smtp-ext.bro 8ce37d97c69b9422bc21fcb7ade1741a2bb83450 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/437bd762589aade6f6a1ac057ca774616eb50d1f 437bd762589aade6f6a1ac057ca774616eb50d1f 2009-04-07T19:44:58-07:00 2009-04-07T19:44:58-07:00 Added a new line based dns logging script (dns-ext.bro) Several other small fixes here and there. 14a867cd48123602f3ccf4f8d23e134fb72d81df Seth Hall hall.692@osu.edu