---

global INTEL_LOG = "/tmp/zeek_block_intel.log";

function log_event(msg: string)
{
    local f = open_for_append(INTEL_LOG);
    print f, msg;
    close(f);
}

event http_header(c: connection, is_orig: bool, name: string, value: string)
{
    if ( ! is_orig ) return;

    if ( to_lower(name) == "host" && /zapret\.telegram/ in value )
    {
        log_event(fmt("HTTP_HOST:%s", value));
    }

    if ( to_lower(name) == "user-agent" && /Windows PowerShell/ in value )
    {
        log_event("HTTP_USERAGENT:Windows PowerShell");
    }
}

event connection_established(c: connection)
{
    if ( c$id$resp_p == 21/tcp )
    {
        log_event(fmt("FTP_PORT:%s->%s", c$id$resp_h, c$id$orig_h));
        print fmt("[ZEEK] FTP DETECTED %s", c$id$orig_h);
    }
}