peritemexpiration.bro

@load base/frameworks/intel
@load frameworks/intel/seen

module Intel;

export {
#    const default_per_item_expiration = 5 min &redef;
    const default_per_item_expiration = 300 &redef;
    redef record MetaData += {
		expire:     double &default=default_per_item_expiration;
		bestbefore: time     &default=network_time();
		testfield: count &optional;
	};
}

const feed_directory = "/etc/bro/site/brozilla";
redef Intel::read_files += {
        feed_directory + "/intel-1.dat",
};

hook extend_match(info: Info, s: Seen, items: set[Item])
{
    local matches = |items|;
	for (item in items) {
        local meta = item$meta;
        if (meta$bestbefore < double_to_time(1.0)) {
            meta$bestbefore = network_time();
            insert(item);
        } else {
            if (meta$bestbefore + double_to_interval(meta$expire) < network_time()) {
                --matches;
                remove(item, F);
                next;
            }
        }
        if ( matches < 1 ) {
		    break;
        }
    }
}
hook Intel::item_expired(indicator: string, indicator_type: Type, metas: set[MetaData])
{
    break;
}