Added log policy hooks.

corelight · May 3, 2022 · 6561c6c · 6561c6c
1 parent 70a4449
commit 6561c6c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/CHANGES b/CHANGES
@@ -1,2 +1,3 @@
+v0.1.2:		Added log policy hooks.
 v0.1.1:		Improved signature based on live traffic analysis.
 v0.1.0:		Initial version.
diff --git a/analyzer/main.zeek b/analyzer/main.zeek
@@ -3,6 +3,8 @@ module Wireguard;
 export {
 	redef enum Log::ID += { LOG };
 
+	global log_policy: Log::PolicyHook;
+
 	## The record type which contains the fields of the Wireguard log.
 	## Wireguard purposefully contains only very limited information. As such, the only
 	## things that we record in the log are wireguard handshakes - since the frequency of handshakes
@@ -67,7 +69,7 @@ function set_session(c: connection)
 
 event zeek_init() &priority=5
 	{
-	Log::create_stream(Wireguard::LOG, [$columns=Info, $ev=log_wireguard, $path="wireguard"]);
+	Log::create_stream(Wireguard::LOG, [$columns=Info, $ev=log_wireguard, $path="wireguard", $policy=log_policy]);
 	}
 
 event Wireguard::handshake_initiation(c: connection, is_orig: bool, sender_index: count, unencrypted_ephemeral: string, encrypted_static: string, encrypted_timestamp: string, mac1: string, mac2: string)