salesforce / GQUIC_Protocol_Analyzer

GQUIC Protocol Analyzer for Zeek (Bro) Network Security Monitor
Other
76 stars 22 forks source link

Compat #4

Closed jbaggs closed 4 years ago

jbaggs commented 4 years ago

Thank you for the work extending the bro-gquic plugin. I have made some modifications to facilitate interaction with other zeek scripts. The parsed info is added to the connection record so scripts can access it as "c$gquic", and the logging step has been moved to an event handler with later priority than record creation, to allow interaction / modification before logging. I also removed the "exists" booleans, as it is fairly conventional in scriptland to check for a field's existence with the "?$" operator.