entrypoint.sh

#!/usr/bin/env bash

set -uo pipefail
shopt -s nocasematch
ENCODING="utf-8"

ZEEK_DIR=${ZEEK_DIR:-"/opt/zeek"}
INTEL_DIR="${ZEEK_DIR}/share/zeek/site/intel"

# create directive to load intel files under /opt/zeek/share/zeek/site/intel
if [[ -d "${INTEL_DIR}" ]] && (( $(find "${INTEL_DIR}" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | wc -l) > 0 )); then
    pushd "${INTEL_DIR}" >/dev/null 2>&1

    INTEL_LOAD_FILE=${INTEL_LOAD_FILE:-"__load__.zeek"}

    cat > "$INTEL_LOAD_FILE" << EOF
# WARNING: This file is automatically generated.
# Do not make direct modifications here.
@load policy/integration/collective-intel
@load policy/frameworks/intel/seen
@load policy/frameworks/intel/do_notice

EOF
    LOOSE_INTEL_FILES=()

    # process subdirectories under INTEL_DIR
    for DIR in $(find . -mindepth 1 -maxdepth 1 -type d 2>/dev/null); do
        if [[ -f "${DIR}"/__load__.zeek ]]; then
            # this intel feed has its own load directive and should take care of itself
            echo "@load ${DIR}" >> "$INTEL_LOAD_FILE"
        else
            # this directory contains "loose" intel files we'll need to load explicitly
            while IFS= read -r line; do
                LOOSE_INTEL_FILES+=( "$line" )
            done < <( find "${INTEL_DIR}/${DIR}" -type f ! -name ".*" 2>/dev/null )
        fi
    done

    # explicitly load all of the "loose" intel files in other subdirectories that didn't load themselves
    if (( ${#LOOSE_INTEL_FILES[@]} )); then
        echo >> "$INTEL_LOAD_FILE"
        echo 'redef Intel::read_files += {' >> "$INTEL_LOAD_FILE"
        for INTEL_FILE in "${LOOSE_INTEL_FILES[@]}"; do
            echo "  \"${INTEL_FILE}\"," >> "$INTEL_LOAD_FILE"
        done
        echo '};' >> "$INTEL_LOAD_FILE"
    fi

    popd >/dev/null 2>&1
fi

# run the default command
exec "$@"