zeek/scripts/policy/protocols/http/var-extraction-uri.zeek
Patrick Kelley 8fd444092b initial
2025-05-07 15:35:15 -04:00

18 lines
445 B
Plaintext

##! Extracts and logs variables from the requested URI in the default HTTP
##! logging stream.
@load base/protocols/http
module HTTP;
redef record Info += {
## Variable names from the URI.
uri_vars: vector of string &optional &log;
};
event http_request(c: connection, method: string, original_URI: string,
unescaped_URI: string, version: string) &priority=2
{
c$http$uri_vars = extract_keys(original_URI, /&/);
}