Merge pull request #104 from nttcom/fix_zeek_dns

dns.logの集約機能追加
nttcom · Mar 2, 2023 · 0b3d410 · 0b3d410
2 parents 6f494a0 + 2533442
commit 0b3d410
Show file tree

Hide file tree

Showing 3 changed files with 918 additions and 2 deletions.
diff --git a/osect_sensor/Infrastructure/edge_cron/Dockerfile b/osect_sensor/Infrastructure/edge_cron/Dockerfile
@@ -213,10 +213,11 @@ RUN mkdir /opt/ot_tools \
     && cp -p ot_tools/broscript/ns.zeek /opt/zeek/share/zeek/site/ \
     && cp -p ot_tools/broscript/main_bacnet.zeek /opt/zeek/share/zeek/site/ \
     && cp -p ot_tools/broscript/consts_bacnet.zeek /opt/zeek/share/zeek/site/ \
+    && cp -p ot_tools/broscript/dns.zeek /opt/zeek/share/zeek/base/protocols/dns/main.zeek \
     && cp -p ot_tools/*.sh /opt/ot_tools/ \
     && cp -p ot_tools/tsharkfields2bacnetservicelog_dict.awk /opt/ot_tools/ \
     && cp -p ot_tools/yaf.awk /opt/ot_tools/ \
-    && cp -pr ot_tools/p0f /opt/
+    && cp -pr ot_tools/p0f /opt/ 
 
 # 環境変数
 RUN printenv | grep -e https_proxy -e HTTPS_PROXY -e http_proxy -e HTTP_PROXY -e no_proxy -e NO_PROXY| awk '{print "export " $1}' > /opt/ot_tools/proxy_env.txt \

diff --git a/osect_sensor/Infrastructure/edge_cron/work/ot_tools/broscript/arp.zeek b/osect_sensor/Infrastructure/edge_cron/work/ot_tools/broscript/arp.zeek
@@ -6,7 +6,7 @@ export {
 	redef enum Log::ID += { LOG };
 
 	type Info: record {
-		ts:		time		&optional &log;
+		ts:		time		&log &optional;
 		orig_mac:	string		&log &optional;
 		orig_ip:	addr		&log &optional;
 		resp_mac:	string		&log &optional;