Re: Replacing the &synchronized attribute in 2.6
Samuel Oehlert <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAMLD0uL=VHsp83HJDwbbwsZyA0sE8oi=Z9Aag-XZDo3zuO-O3w@mail.gmail.com> |
Mike Dopheide wrote a blog post (on the Zeek blog) about that exact topic not too long ago. He had spent a lot of time at work fixing a bug with one of our policies and had this deep dive in the process. It's a good read. https://blog.zeek.org/2018/07/broker-is-coming-part-2-replacing.html - Sam On Thu, Mar 14, 2019 at 1:19 PM Michał Purzyński <[email protected]> wrote: > Thanks, using the configuration framework is easier indeed. > > Just for the sake of discussing some broker code - do we have examples how > people replace the &synchronized attribute? > > On Thu, Mar 14, 2019 at 6:00 AM Hosom, Stephen M <[email protected]> > wrote: > >> Michal, >> >> >> For the use case in your email, the best option available to you is the >> Configuration Framework. >> >> >> https://docs.zeek.org/en/stable/frameworks/configuration.html >> >> >> # First file: >> >> module TestModule; >> >> export { >> >> option whitelist_scan_ip: set[subnet] = {}; >> >> redef Config::config_files += { "/path/to/my/config.dat" }; >> >> } >> >> >> # /path/to/my/config.dat: >> >> TestModule::whitelist_scan_ip = 10.1.2.0/24,10.1.3.0/24,10.1.4.0/24 >> >> >> >> Thanks, >> >> Stephen >> >> ________________________________ >> From: [email protected] <[email protected]> on behalf of Jan >> Grashöfer <[email protected]> >> Sent: Thursday, March 14, 2019 6:02:35 AM >> To: [email protected] >> Subject: Re: [Zeek] Replacing the &synchronized attribute in 2.6 >> >> Message received from outside the Battelle network. Carefully examine it >> before you open any links or attachments. >> >> On 14/03/2019 10:43, Michał Purzyński wrote: >> > do we have any example how to replace the old &synchronized attribute in >> > the new Broker-powered world? I looked at the documentation (it's >> extremely >> > verbose) and found nothing that I could relate to. >> >> https://docs.zeek.org/en/stable/frameworks/broker.html#porting-guide >> >> I guess data stores are the way to go. >> Jan >> _______________________________________________ >> Zeek mailing list >> [email protected] >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek >> >> _______________________________________________ >> Zeek mailing list >> [email protected] >> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek >> > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek