50b238454dd2433b0e74c9c50ff59bb0854db4ae Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/f047c2f7b54f5c60d196d71f2fd821e643a6838b f047c2f7b54f5c60d196d71f2fd821e643a6838b

2009-11-16T05:23:21-08:00

Fixed a problem with the command being set incorrectly when the ftp_ext event fires. ffdd2789289efe768ec226992f1dfc18f3bbac3b Seth Hall hall.692@osu.edu 15332e36b04557298486d964329bca3a9b157bb9 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/50b238454dd2433b0e74c9c50ff59bb0854db4ae 50b238454dd2433b0e74c9c50ff59bb0854db4ae

2009-11-15T21:29:12-08:00

Fixed some logging issues with ftp-ext Username and password are now included in their own fields. b11002e92097a9505729b67aa9dd0d6c9318831d Seth Hall hall.692@osu.edu 39194c84a9f8a61340bba28c718f60b99976c4fe Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/15332e36b04557298486d964329bca3a9b157bb9 15332e36b04557298486d964329bca3a9b157bb9

2009-11-13T12:00:32-08:00

Renamed ssl-known-certs to ssl-ext. *_ext logging events are now all handled at lowered priority. cedc3be5bf4bee0c49ffee0e28cd623bc843842a Seth Hall hall.692@osu.edu b0bc21def87278b16d3816cc5a52d63fa35bb449 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/39194c84a9f8a61340bba28c718f60b99976c4fe 39194c84a9f8a61340bba28c718f60b99976c4fe

2009-11-04T07:09:48-08:00

Forced logging should work with client and server requests now. Bug reported by Justin Azoff. c4cb1a1095c97ea00999591fc577b6704f29b9d7 Seth Hall hall.692@osu.edu 8442446ea6491cdeca73439ae3585ec7cb6e8852 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/b0bc21def87278b16d3816cc5a52d63fa35bb449 b0bc21def87278b16d3816cc5a52d63fa35bb449

2009-11-04T06:20:14-08:00

Fixed some issues with external data sources in http-ext. be90024e24c894895925dfd926ad829f4ac02400 Seth Hall hall.692@osu.edu 7d4f8eff57f1c3aff362a7db6982882ee4f61260 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/8442446ea6491cdeca73439ae3585ec7cb6e8852 8442446ea6491cdeca73439ae3585ec7cb6e8852

2009-11-03T19:23:07-08:00

Fixed by report from Justin: If "Neither" is chosen for the direction of logged traffic, the file or files are still opened to support the forced logging feature. The http logging script now supports forced logging for the originator and responder of HTTP transactions. 810f02087409dc008a4fdff2340080a0ce4a0680 Seth Hall hall.692@osu.edu 93b819b51912747623e65aea714a53be1b82199b Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/7d4f8eff57f1c3aff362a7db6982882ee4f61260 7d4f8eff57f1c3aff362a7db6982882ee4f61260

2009-11-02T19:28:06-08:00

SSH now uses default_check_threshold Fixed a number of bugs. ec3025c1297d5c8ad67e4559b21e31ea0d3d3ff0 Seth Hall hall.692@osu.edu c087806250e53878ca2b79ddc6c2603794677fb6 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/93b819b51912747623e65aea714a53be1b82199b 93b819b51912747623e65aea714a53be1b82199b

2009-11-02T10:38:23-08:00

Bug fixing for crashes and run-time errors. 395dc0723a3cf21a133e68c125f9edf6e813fe11 Seth Hall hall.692@osu.edu 31eb420c198689adfcac7c631fe2d41a7ac64eba Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/c087806250e53878ca2b79ddc6c2603794677fb6 c087806250e53878ca2b79ddc6c2603794677fb6

2009-11-02T09:41:46-08:00

Hopefully fixed a bug that was causing bro to crash. A new other logging nits too. 402e7579da255c12606ad5a6b26c7aafaec07002 Seth Hall hall.692@osu.edu e25e8fd27db8bad302d1f9dde7ceb3ba7761e50e Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/31eb420c198689adfcac7c631fe2d41a7ac64eba 31eb420c198689adfcac7c631fe2d41a7ac64eba

2009-11-02T08:42:04-08:00

small bug in logging.smtp-ext.bro 951ea6e545834edd1f3d94d3bd2641dfea195f34 Seth Hall hall.692@osu.edu 4ce1c93eea633ed7ebab2cf2dfaef7d897dc2028 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/e25e8fd27db8bad302d1f9dde7ceb3ba7761e50e e25e8fd27db8bad302d1f9dde7ceb3ba7761e50e

2009-11-02T08:39:00-08:00

Rewrite of http-ext.bro. Changed the logging framework API function from "choose" to "get_file" Added an option for force disabling logging in the "get_file" function. 55f02221713fd573bda0868f13d5efe724b0b41e Seth Hall hall.692@osu.edu 9280ee4d91b9625ce1f8c741e0b292ff553d6368 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/4ce1c93eea633ed7ebab2cf2dfaef7d897dc2028 4ce1c93eea633ed7ebab2cf2dfaef7d897dc2028

2009-10-31T20:35:50-07:00

Fixed a problem with accurately recording the received headers. e4bedae8a9d0dbc8a2011baa285288fe2d90e6fa Seth Hall hall.692@osu.edu 5d9b7d65fef72aae71782149be90846c41e71269 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/9280ee4d91b9625ce1f8c741e0b292ff553d6368 9280ee4d91b9625ce1f8c741e0b292ff553d6368

2009-10-30T13:25:13-07:00

Fixed a problem with the hosts/directions functions. f8368f55dcb9ff410b95eb9702abe7c52808002a Seth Hall hall.692@osu.edu 90586a1aa29ecd98ff9115c18dd4ae575ad898aa Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/5d9b7d65fef72aae71782149be90846c41e71269 5d9b7d65fef72aae71782149be90846c41e71269

2009-10-30T11:54:38-07:00

Fixed the problem with the header not being printed upon file rotation. Add a function named "buffer" to enable and disable the buffering for a log type. 021c52815df0aa0f5c634e48ad39ed9671c22d60 Seth Hall hall.692@osu.edu 4aeab7285d5c0a923c0f8ffe72f61caa645da82e Justin Azoff justin@bouncybouncy.net http://github.com/sethhall/bro_scripts/commit/90586a1aa29ecd98ff9115c18dd4ae575ad898aa 90586a1aa29ecd98ff9115c18dd4ae575ad898aa

2009-10-30T10:41:05-07:00

2009-10-30T07:55:50-07:00

add missing header fields 8add19245c37280f2a734a994f529e6939425da8 Seth Hall hall.692@osu.edu f7973a4d46aca32c5c0773ecef95c22a96c0d227 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/4aeab7285d5c0a923c0f8ffe72f61caa645da82e 4aeab7285d5c0a923c0f8ffe72f61caa645da82e

2009-10-30T07:03:58-07:00

Justin reported a problem with when geo location is looked up. It's fixed now. 68d5dbf8220b8841b8904cba0e9f6d5118d93b48 Seth Hall hall.692@osu.edu d7dad9d6c45254748a57ed3b1e5a6b905d7cb7ee Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/f7973a4d46aca32c5c0773ecef95c22a96c0d227 f7973a4d46aca32c5c0773ecef95c22a96c0d227

2009-10-29T23:38:46-07:00

Forgot to move a field into the ssh state record. 7e38af61334aea8ee06707030c2a72a9d7c1e770 Seth Hall hall.692@osu.edu bec12510d567ab5cef537fe25fa0df9e8baeb3e6 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/d7dad9d6c45254748a57ed3b1e5a6b905d7cb7ee d7dad9d6c45254748a57ed3b1e5a6b905d7cb7ee

2009-10-29T23:12:41-07:00

More small cleanup. Logging now supports file interval rotation while waiting for the file_opened event. Removed loading of the notice script from smtp-ext. d2b649d0dad51e9771432cbbcf555381a35ef0f2 Seth Hall hall.692@osu.edu 26dfb230159ed5287cd7b0c7a75e8968abde6a08 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/bec12510d567ab5cef537fe25fa0df9e8baeb3e6 bec12510d567ab5cef537fe25fa0df9e8baeb3e6

2009-10-29T22:57:50-07:00

Defined headers in the three analyzers using the new logging framework. This feature is still broken because when files are rotated, the header isn't printed in the new file. be9c427b5373b1b21dab2990e4c3a32045083d81 Seth Hall hall.692@osu.edu 66d187ecc72b5f8d93f30215ff96ba889fb25bb8 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/26dfb230159ed5287cd7b0c7a75e8968abde6a08 26dfb230159ed5287cd7b0c7a75e8968abde6a08

2009-10-29T22:15:49-07:00

Renamed the logging scripts to make them easy to enable globally with a prefix. df78788bf766767cfaef944ba258822ad3b8a6cb Seth Hall hall.692@osu.edu c940184f59d43cb6853844dd65e9385407f3cf6a Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/66d187ecc72b5f8d93f30215ff96ba889fb25bb8 66d187ecc72b5f8d93f30215ff96ba889fb25bb8

2009-10-29T22:14:12-07:00

load global-ext from ssh-ext-logging 827ffd005334be1c5998c98bb0adf5a78740f5dc Seth Hall hall.692@osu.edu 55825d0c1adca843045d7b6883115e4e17932282 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/c940184f59d43cb6853844dd65e9385407f3cf6a c940184f59d43cb6853844dd65e9385407f3cf6a

2009-10-29T22:11:25-07:00

Separation of logging from ftp-ext. ftp-ext.bro now throws the ftp_ext event. b2b4c0ec9d3d481774ce4498a9a613d638ede21b Seth Hall hall.692@osu.edu 59dcf5e3a54e441dbcadf2058c9cba3a74508e0c Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/55825d0c1adca843045d7b6883115e4e17932282 55825d0c1adca843045d7b6883115e4e17932282

2009-10-29T13:04:04-07:00

Get rid of some warnings. a5b4675eec7256c19eaa1fe59e5df7f24e7a9387 Seth Hall hall.692@osu.edu 6a8f49de37ca40583946b472e2365067ede3fc75 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/59dcf5e3a54e441dbcadf2058c9cba3a74508e0c 59dcf5e3a54e441dbcadf2058c9cba3a74508e0c

2009-10-29T12:55:54-07:00

File names are now stored as a string set. The mailer agent is now logged. Reworking to get rid of some global variables. Recording some extra data (not all logged). 02639ac593d315a71c8eba1adf0c39f841137321 Seth Hall hall.692@osu.edu c07b4c9aecc510432600515d7f1db7bca299189f Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/6a8f49de37ca40583946b472e2365067ede3fc75 6a8f49de37ca40583946b472e2365067ede3fc75

2009-10-29T12:54:13-07:00

Now counts rejects during the MAIL FROM command. More rewording and slight reworking. 569cc51cb970a405aab5c9d3c5abdda852c00a2e Seth Hall hall.692@osu.edu c8c4d1ecc2d6f8c5466c5db1aaccd93704a029ce Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/c07b4c9aecc510432600515d7f1db7bca299189f c07b4c9aecc510432600515d7f1db7bca299189f

2009-10-29T11:02:49-07:00

Reworked and significantly better script for raising a notice when too many recipients are being rejected over email. e69f0cbd25a89edcabdc51500a98b56828079c9e Seth Hall hall.692@osu.edu 1b7022f70a2fa9f0a55023f27c741c0d7e82f6c4 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/c8c4d1ecc2d6f8c5466c5db1aaccd93704a029ce c8c4d1ecc2d6f8c5466c5db1aaccd93704a029ce

2009-10-29T09:01:12-07:00

Added the default option for the logging framework to not apply the raw_output attribute to files. 3d48f9cd5170b6fca5b8adcbaa39343ae9b1b1cf Seth Hall hall.692@osu.edu 05b40d1ccb4ae57872518510bf1cdd00f77eacca Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/1b7022f70a2fa9f0a55023f27c741c0d7e82f6c4 1b7022f70a2fa9f0a55023f27c741c0d7e82f6c4

2009-10-29T08:52:46-07:00

Mostly just style and naming changes here. c7cc986f040503d51ec6e09ea3895c1c5b09e00a Seth Hall hall.692@osu.edu f1208b661301340b92e88faee919a0b4fdc50771 Seth Hall hall.692@osu.edu http://github.com/sethhall/bro_scripts/commit/05b40d1ccb4ae57872518510bf1cdd00f77eacca 05b40d1ccb4ae57872518510bf1cdd00f77eacca

2009-10-29T08:27:02-07:00

Short circuit in the simple case of being interested in everything. This avoids running is_local_addr *a lot* of times. 4af0f254b738c272be0ef7e59f8fe95dd0d1a797 Seth Hall hall.692@osu.edu 52704ce44238692cdba18a364b5420111840f498 Justin Azoff justin@bouncybouncy.net http://github.com/sethhall/bro_scripts/commit/f1208b661301340b92e88faee919a0b4fdc50771 f1208b661301340b92e88faee919a0b4fdc50771

2009-10-29T08:17:20-07:00

2009-10-29T07:58:13-07:00

have total be the number of connections this should maybe be MAIL or RCPT and not HELO 5932159b8898a1a26731d78e99d5c516a1b4a4cc Seth Hall hall.692@osu.edu