Skip to content

Instantly share code, notes, and snippets.

@sethhall
Created May 9, 2014 16:23
Show Gist options
  • Save sethhall/710c198bd920f38e9d4c to your computer and use it in GitHub Desktop.
Save sethhall/710c198bd920f38e9d4c to your computer and use it in GitHub Desktop.
Add HTTP POST to http.log
redef record HTTP::Info += {
post_body: string &optional &log;
};
redef record fa_file += {
http_log: HTTP::Info &optional;
};
event http_get_post_body(f: fa_file, data: string)
{
if ( ! f$http_log?$post_body )
f$http_log$post_body = data;
else
f$http_log$post_body = f$http_log$post_body + data;
}
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( f$source == "HTTP" && is_orig &&
c$http$method == "POST" )
{
#Files::add_analyzer(f, Files::ANALYZER_EXTRACT);
f$http_log = c$http;
Files::add_analyzer(f, Files::ANALYZER_DATA_EVENT, [$stream_event=http_get_post_body]);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment