certificate-event-cache.zeek

X509

This script sets up the certificate event cache handling of Zeek.

The Zeek core provided a method to skip certificate processing for known certificates. For more details about this functionality, see x509_set_certificate_cache.

This script uses this feature to lower the amount of processing that has to be performed by Zeek by caching all certificate events for common certificates. For these certificates, the parsing of certificate information in the core is disabled. Instead, the cached events and data structures from the previous certificates are used.

Namespace:: X509
Imports:: base/files/x509/main.zeek

Summary

Runtime Options

`X509::caching_required_encounters`: `count` `&redef`	How often do you have to encounter a certificate before caching the events for it.
`X509::caching_required_encounters_interval`: `interval` `&redef`	The timespan over which caching_required_encounters has to be reached
`X509::certificate_cache_max_entries`: `count` `&redef`	Maximum size of the certificate event cache
`X509::certificate_cache_minimum_eviction_interval`: `interval` `&redef`	After a certificate has not been encountered for this time, it may be evicted from the certificate event cache.