Hello world,
I’ve a little question for the function check_threshold() from base/utils/thresholds.zeek, i’d like to add a threshold for the notice, but in order to make the question more brief, here I use the print setting instead of notice:
@load base/frameworks/notice/main
@load base/utils/thresholds
module Conn;
export{
redef enum Notice::Type += { IP_WIRED };
global detection_range: set[subnet] = set( 192.168.1.0/16 );
global count_threshold: GLOBAL::TrackCount;
global notice_thresholds: vector of count = {1, 10};
}
event connection_state_remove(c:connection)
{
if (check_threshold(notice_thresholds, count_threshold) && c$id$orig_h in detection_range)
{
print fmt("yes %s is in %s.", c$id$orig_h, detection_range);
}
}
(or just click Try Zeek and choice exercise traffic and run)
I want the ip in the detection range in this packet to be printed when it appears for the first time and the tenth time. What changes should I make please?
Looking forward to your reply and Thank you very very much