Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Business Unit everywhere
##! Add Business Unit to all logs with an "id" field.
module BusinessUnit;
export {
option BusinessUnit::networks: table[subnet] of string = set();
}
redef record conn_id += {
## The business unit seen as the connection originator.
orig_bu: string &log &optional;
## The business unit seen as the connection responder.
resp_bu: string &log &optional;
};
event new_connection(c: connection) &priority=4
{
if ( c$id$orig_h in BusinessUnit::networks )
c$id$orig_bu = BusinessUnit::networks[c$id$orig_h];
if ( c$id$resp_h in BusinessUnit::networks )
c$id$resp_bu = BusinessUnit::networks[c$id$resp_h];
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment