37 lines
1.1 KiB
Plaintext
37 lines
1.1 KiB
Plaintext
# @TEST-EXEC: zeek -b -r $TRACES/smtp-multi-addr.pcap %INPUT
|
|
# @TEST-EXEC: btest-diff intel.log
|
|
|
|
# @TEST-START-FILE intel.dat
|
|
#fields indicator indicator_type meta.source meta.desc meta.url
|
|
jan.grashoefer@gmail.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000
|
|
jan.grashoefer@cern.ch Intel::EMAIL source1 test entry http://some-data-distributor.com/100000
|
|
jan.grashofer@cern.ch Intel::EMAIL source1 test entry http://some-data-distributor.com/100000
|
|
addr-spec@example.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000
|
|
angle-addr@example.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000
|
|
name-addr@example.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000
|
|
# @TEST-END-FILE
|
|
|
|
@load base/protocols/smtp
|
|
@load base/frameworks/intel
|
|
@load frameworks/intel/seen
|
|
|
|
redef Intel::read_files += { "intel.dat" };
|
|
|
|
event zeek_init()
|
|
{
|
|
suspend_processing();
|
|
}
|
|
|
|
event Input::end_of_data(name: string, source: string)
|
|
{
|
|
continue_processing();
|
|
}
|
|
|
|
event SMTP::log_smtp(rec: SMTP::Info)
|
|
{
|
|
for ( adr in rec$to )
|
|
{
|
|
print fmt("Addr: '%s'", adr);
|
|
}
|
|
}
|