policy/integration/barnyard2/main.zeek
- Barnyard2
This script lets Barnyard2 integrate with Zeek. It receives alerts from Barnyard2 and logs them. In the future it will do more correlation and derive new notices from the alerts.
- Namespace
Barnyard2
- Imports
Summary
Types
Redefinitions
Hooks
Functions
This can convert a Barnyard |
Detailed Interface
Types
- Barnyard2::Info
- Type
-
- ts:
time
&log
Timestamp of the alert.
- pid:
Barnyard2::PacketID
&log
Associated packet ID.
- alert:
Barnyard2::AlertData
&log
Associated alert data.
- ts:
Hooks
Functions
- Barnyard2::pid2cid
- Type
function
(p:Barnyard2::PacketID
) :conn_id
This can convert a Barnyard
Barnyard2::PacketID
value to aconn_id
value in the case that you might need to index into an existing data structure elsewhere within Zeek.