[Zeek] Replacing the &synchronized attribute in 2.6

Hosom, Stephen M hosom at battelle.org
Thu Mar 14 05:58:32 PDT 2019


Michal,


For the use case in your email, the best option available to you is the Configuration Framework.


https://docs.zeek.org/en/stable/frameworks/configuration.html


# First file:

module TestModule;

export {

option whitelist_scan_ip: set[subnet] = {};

redef Config::config_files += { "/path/to/my/config.dat" };

}


# /path/to/my/config.dat:

TestModule::whitelist_scan_ip = 10.1.2.0/24,10.1.3.0/24,10.1.4.0/24



Thanks,

Stephen

________________________________
From: zeek-bounces at zeek.org <zeek-bounces at zeek.org> on behalf of Jan Grashöfer <jan.grashoefer at gmail.com>
Sent: Thursday, March 14, 2019 6:02:35 AM
To: zeek at zeek.org
Subject: Re: [Zeek] Replacing the &synchronized attribute in 2.6

Message received from outside the Battelle network. Carefully examine it before you open any links or attachments.

On 14/03/2019 10:43, Michał Purzyński wrote:
> do we have any example how to replace the old &synchronized attribute in
> the new Broker-powered world? I looked at the documentation (it's extremely
> verbose) and found nothing that I could relate to.

https://docs.zeek.org/en/stable/frameworks/broker.html#porting-guide

I guess data stores are the way to go.
Jan
_______________________________________________
Zeek mailing list
zeek at zeek.org
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek



More information about the Zeek mailing list