Fix Zeek won't run if no scripts in path (#156)

secureworks · Sep 27, 2022 · 29d0df0 · 29d0df0
1 parent a0e5f64
commit 29d0df0
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-3.2.4
+3.2.5
diff --git a/dalton-agent/dalton-agent.py b/dalton-agent/dalton-agent.py
@@ -1206,7 +1206,10 @@ def run_zeek(json_logs):
     zeek_command = "cd %s && %s -C -r %s" % (IDS_LOG_DIRECTORY, IDS_BINARY, PCAP_FILES[0])
     if json_logs:
         zeek_command += " -e 'redef LogAscii::use_json=T;redef LogAscii::json_timestamps=JSON::TS_ISO8601;'"
-    zeek_command += " /opt/dalton-agent/zeek_scripts/*"
+
+    if len([f for f in os.listdir('/opt/dalton-agent/zeek_scripts/') if not f.startswith('.')]) > 0:
+        zeek_command += " /opt/dalton-agent/zeek_scripts/*"
+
     print_msg("Starting Zeek and Running Pcap(s)...")
     print_debug("Running Zeek with the following command command:\n%s" % zeek_command)
     zeek_output_fh = open(JOB_IDS_LOG, "w")