addr_scan_policy example

addr_scan_policy.bro

export {
        const scan_ports: set[port] = {22/tcp,3389/tcp} &redef;
}

hook Scan::addr_scan_policy(scanner: addr, victim: addr, scanned_port: port)
{
        if(scanned_port !in scan_ports)
                break;
}