main.zeek¶

Summary¶

`Unified2::classification_config`: `string` `&redef`	The classification.config file you would like to use for your alerts.
`Unified2::gen_msg`: `string` `&redef`	The gen-msg.map file you would like to use for your alerts.
`Unified2::sid_msg`: `string` `&redef`	The sid-msg.map file you would like to use for your alerts.
`Unified2::watch_dir`: `string` `&redef`	Directory to watch for Unified2 records.
`Unified2::watch_file`: `string` `&redef`	File to watch for Unified2 files.

`Unified2::Info`: `record` `&log`
`Unified2::PacketID`: `record` `&log`

`Log::ID`: `enum`	`Unified2::LOG`
`fa_file`: `record` `&redef`	New Fields `fa_file` u2_events: `table` [`count`] of `Unified2::IDSEvent` `&optional` `&create_expire` = `5.0 secs` `&expire_func` = `function` Recently received IDS events.

`Unified2::alert`: `event`	Reconstructed “alert” which combines related events and packets.
`Unified2::log_unified2`: `event`	The event for accessing logged records.

Unified2::classification_config¶

The classification.config file you would like to use for your alerts.

Unified2::gen_msg¶

The gen-msg.map file you would like to use for your alerts.

Unified2::sid_msg¶

The sid-msg.map file you would like to use for your alerts.

Unified2::watch_dir¶

Directory to watch for Unified2 records.

Unified2::watch_file¶

File to watch for Unified2 files.

Unified2::Info¶

Type

record

ts: time &log: Timestamp attached to the alert.
id: Unified2::PacketID &log: Addresses and ports for the connection.
sensor_id: count &log: Sensor that originated this event.
signature_id: count &log: Sig id for this generator.
signature: string &optional &log: A string representation of the signature_id field if a sid_msg.map file was loaded.
generator_id: count &log: Which generator generated the alert?
generator: string &optional &log: A string representation of the generator_id field if a gen_msg.map file was loaded.
signature_revision: count &log: Sig revision for this id.
classification_id: count &log: Event classification.
classification: string &optional &log: Descriptive classification string.
priority_id: count &log: Event priority.
event_id: count &log: Event ID.
packet: string &optional &log: Some of the packet data.

Attributes