<commit_before># Support for UDP, ICMP, and non-established TCP connections
# This will only generate Intel matches when a connection is removed from Bro
# CrowdStrike 2014
# <EMAIL>

@load base/frameworks/intel
@load policy/frameworks/intel/seen/where-locations

event Conn::log_conn(rec: Conn::Info)
{
if ( rec?$proto && ( rec$proto != tcp || ( rec?$history && rec$proto == tcp && "h" !in rec$history ) ) ) 
  {
  # duration, start_time, addl, and hot are required fields although they are not used by Intel framework
  local dur: interval;
  local history: string;

  if ( rec?$duration )
    dur = rec$duration;
  else dur = 0secs;

  if ( rec?$history )
    history = rec$history;
  else history = "";

  local c = [$uid = rec$uid,$id = rec$id,$history = history,$duration = dur,$start_time = 0,$addl = "",$hot = 0];<commit_msg>Updated to run in Bro 2.4<commit_after># Support for UDP, ICMP, and non-established TCP connections
# This will only generate Intel matches when a connection is removed from Bro
# CrowdStrike 2014
# <EMAIL>
#
# Update by: <NAME> 8/7/2015
#  - updated to run in Bro 2.4

@load base/frameworks/intel
@load policy/frameworks/intel/seen/where-locations

event Conn::log_conn(rec: Conn::Info)
{
if ( rec?$proto && ( rec$proto != tcp || ( rec?$history && rec$proto == tcp && "h" !in rec$history ) ) )
  {
  # duration, start_time, addl, and hot are required fields although they are not used by Intel framework
  # for Bro 2.4 we also need to setup $orig and $resp for the connection record being sent to Intel::seen
  # we also need to add the start_time and service for the conn record for Bro 2.4
  local dur: interval;
  local history: string;
  local orig_ep: endpoint;
  local resp_ep: endpoint;
  local start: time;
  local service: set[string];
  local c: connection;

  start = rec$ts;

  orig_ep = [$size = 0,$state = 0,$flow_label = 0];
  resp_ep = [$size = 0,$state = 0,$flow_label = 0];

  if ( rec?$service )
    add service[rec$service];
  else add service[""];

  if ( rec?$duration )
    dur = rec$duration;
  else dur = 0secs;

  if ( rec?$history )
    history = rec$history;
  else history = "";

  c = [$id = rec$id,$orig = orig_ep,$resp = resp_ep,$start_time = start,$duration = dur,$service = service,$history = history,$uid = rec$uid];
{'fraction_non_alphanumeric': 0.13123359580052493, 'fraction_numerical': 0.01399825021872266, 'mean_word_length': 3.939524838012959, 'pattern_counts': {'":': 0, '<': 6, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '249516', 'n_tokens_mistral': 784, 'n_tokens_neox': 734, 'n_words': 257}