Business Unit everywhere

bu-everywhere.zeek

##! Add Business Unit to all logs with an "id" field.

module BusinessUnit;

export {
        option BusinessUnit::networks: table[subnet] of string = set();
}

redef record conn_id += {
        ## The business unit seen as the connection originator.
        orig_bu:       string &log &optional;
        ## The business unit seen as the connection responder.
        resp_bu:       string &log &optional;
};

event new_connection(c: connection) &priority=4
        {
        if ( c$id$orig_h in BusinessUnit::networks )
                c$id$orig_bu = BusinessUnit::networks[c$id$orig_h];

        if ( c$id$resp_h in BusinessUnit::networks )
                c$id$resp_bu = BusinessUnit::networks[c$id$resp_h];
        }