<commit_before>@load global-ext
@load http-ext

@load signatures
redef signature_files += "http-ext-identified-files.sig";

module HTTP;

export {
	redef enum Notice += {
		# This notice is thrown when the file extension doesn't 
		# seem to match the file contents.
		HTTP_IncorrectFileType, 
	};
	
	# MIME types that you'd like this script to identify and log.
	const watched_mime_types = /application\/x-dosexec/
	                         | /application\/x-executable/ &redef;
	
	# URLs included here are not logged and notices are not thrown.
	# Take care when defining regexes to not be overly broad.
	const ignored_urls = /^http:\/\/www\.download\.windowsupdate\.com\// &redef;
	
	# Create regexes that *should* in be in the urls for specifics mime types.
	# Notices are thrown if the pattern doesn't match the url for the file type.
	const mime_types_extensions: table[string] of pattern = {
		["application/x-dosexec"] = /\.([eE][xX][eE]|[dD][lL][lL])/,
	} &redef;
}

# Don't delete the http sessions at the end of the request!
redef watch_reply=T;

# Make the default signature action ignore anything beginning with "matchfile"
function default_signature_action(sig: string): SigAction
	{
	if ( /^matchfile-/ in sig )
		return SIG_IGNORE;
	else
		return SIG_ALARM;
	}<commit_msg>Better detection for MS updates.<commit_after>@load global-ext
@load http-ext

@load signatures
redef signature_files += "http-ext-identified-files.sig";

module HTTP;

export {
	redef enum Notice += {
		# This notice is thrown when the file extension doesn't 
		# seem to match the file contents.
		HTTP_IncorrectFileType, 
	};
	
	# MIME types that you'd like this script to identify and log.
	const watched_mime_types = /application\/x-dosexec/
	                         | /application\/x-executable/ &redef;
	
	# URLs included here are not logged and notices are not thrown.
	# Take care when defining regexes to not be overly broad.
	const ignored_urls = /^http:\/\/(au\.|www\.)?download\.windowsupdate\.com\/msdownload\/update/ &redef;
	
	# Create regexes that *should* in be in the urls for specifics mime types.
	# Notices are thrown if the pattern doesn't match the url for the file type.
	const mime_types_extensions: table[string] of pattern = {
		["application/x-dosexec"] = /\.([eE][xX][eE]|[dD][lL][lL])/,
	} &redef;
}

# Don't delete the http sessions at the end of the request!
redef watch_reply=T;

# Make the default signature action ignore anything beginning with "matchfile"
function default_signature_action(sig: string): SigAction
	{
	if ( /^matchfile-/ in sig )
		return SIG_IGNORE;
	else
		return SIG_ALARM;
	}
{'fraction_non_alphanumeric': 0.1056848531095002, 'fraction_numerical': 0.0, 'mean_word_length': 3.6161971830985915, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 3, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7531377', 'n_tokens_mistral': 875, 'n_tokens_neox': 812, 'n_words': 290}