CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #7830 from Security-Onion-Solutions/dougburks-patch-1

Browse Source 
FIX: Improve Zeek file extraction #7829
This commit is contained in:
Doug Burks
2022-04-20 14:13:13 -04:00
committed by GitHub
parent 40d9335573 15ef0968d9
commit 3aac644da5
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
salt/zeek/policy/securityonion/file-extraction/extract.zeek
View File

@@ -38,12 +38,12 @@ event file_state_remove(f: fa_file)
if ( !f$info?$extracted || FileExtract::prefix == "" ) { if ( !f$info?$extracted || FileExtract::prefix == "" ) {
return; return;
} }
# Check some conditions so we know the file is intact: # Check if any of the following conditions exist:
# Check for MD5 # - missing MD5
# Check for total_bytes # - total_bytes exists (some protocols aren't populating this field) but is 0
# Check for missing bytes # - missing bytes
# Check if timed out # - timed out
if ( !f$info?$md5 || !f?$total_bytes || f$missing_bytes > 0 || f$info$timedout) { if ( !f$info?$md5 || (f?$total_bytes && f$total_bytes == 0) || f$missing_bytes > 0 || f$info$timedout) {
# Delete the file if it didn't pass our requirements check. # Delete the file if it didn't pass our requirements check.
local nuke = fmt("rm %s/%s", FileExtract::prefix, f$info$extracted); local nuke = fmt("rm %s/%s", FileExtract::prefix, f$info$extracted);