type nfstream
All checks were successful
Build and Deploy MITM Webserver / build (push) Successful in 16s
All checks were successful
Build and Deploy MITM Webserver / build (push) Successful in 16s
This commit is contained in:
@@ -29,6 +29,13 @@ def _merge_metadata(base: Optional[Dict[str, Any]], extra: Dict[str, Any]) -> Di
|
||||
return merged
|
||||
|
||||
|
||||
def _safe_text(value: Any) -> Optional[str]:
|
||||
if value is None:
|
||||
return None
|
||||
text = str(value).strip()
|
||||
return text if text else None
|
||||
|
||||
|
||||
def _infer_is_encrypted(payload: Dict[str, Any]) -> Optional[bool]:
|
||||
application_name = str(payload.get("application_name") or "").upper()
|
||||
if any(token in application_name for token in ("TLS", "HTTPS", "QUIC", "SSL")):
|
||||
@@ -60,11 +67,11 @@ def _build_enrichment(payload: Dict[str, Any], iface: str, flow_key: str) -> Dic
|
||||
)
|
||||
|
||||
return {
|
||||
"app_protocol": payload.get("application_name"),
|
||||
"app_master_protocol": payload.get("application_name"),
|
||||
"app_category": payload.get("application_category_name"),
|
||||
"app_confidence": payload.get("application_confidence"),
|
||||
"app_hostname": payload.get("requested_server_name"),
|
||||
"app_protocol": _safe_text(payload.get("application_name")),
|
||||
"app_master_protocol": _safe_text(payload.get("application_name")),
|
||||
"app_category": _safe_text(payload.get("application_category_name")),
|
||||
"app_confidence": _safe_text(payload.get("application_confidence")),
|
||||
"app_hostname": _safe_text(payload.get("requested_server_name")),
|
||||
"app_is_encrypted": _infer_is_encrypted(payload),
|
||||
"dpi_metadata": {"nfstream": metadata},
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user