gourmetproject/gourmet

Minimal mode and verbose mode

spitfire55 opened this issue · 0 comments

If a user only wants to log Connection objects that have at least one analyzer, and ignore everything else, they should be able to.

For example, if someone wants to write an analyzer that filters for DNS traffic that contains domains ending in .io, they should be able to configure Gourmet to only log Connections that meet this filter, and ignore/drop everything else.

To implement this:

  1. Create a new config.yml option called capture_mode with three options: minimal, normal, and payloads.
  2. If minimal is set, only log connections that have met one or filters for the loaded analyzers
  3. If normal is set, log all connections objects and any analyzer results (default, current mode)
  4. If verbose is set, log all connection objects, a base64 dump of the connection payload, and any analyzer results