Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Business Unit everywhere
##! Add Business Unit to all logs with an "id" field.
module BusinessUnit;
export {
option BusinessUnit::networks: table[subnet] of string = set();
redef record conn_id += {
## The business unit seen as the connection originator.
orig_bu: string &log &optional;
## The business unit seen as the connection responder.
resp_bu: string &log &optional;
event new_connection(c: connection) &priority=4
if ( c$id$orig_h in BusinessUnit::networks )
c$id$orig_bu = BusinessUnit::networks[c$id$orig_h];
if ( c$id$resp_h in BusinessUnit::networks )
c$id$resp_bu = BusinessUnit::networks[c$id$resp_h];
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment