tm_query_notices.bro

module Notice;

export {
    redef enum Action += {
        ACTION_TM_QUERY,
    };

    const tm_query_types: set[Type] = {} &redef;
}

hook policy(n: Info)
{
    if ( n$note !in tm_query_types )
        return;
        
    add n$actions[ACTION_TM_QUERY];
    TimeMachine::dump_conn(n$conn);
}