Re: Bro/Zeek ATT&CK-based Analytics and Reporting (BZAR), by MITRE
"Fernandez, Mark I" <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <DM2PR09MB0778CF94309BDF215C46E37FCF580@DM2PR09MB0778.namprd09.prod.outlook.com> |
Hi Gary, >> Is this developed for Bro/Zeek 2.5.5? I'm getting errors when attempting to load this in Bro/Zeek 2.6.1. Yes, I used v2.5.x. What types of errors are you getting? Is it @load errors with SMB, by chance? One thing I know changed with v2.6 is that the SMB analyzer was previously disabled by default in v2.5.x and I believe it is enable by default in v2.6. In main.bro line 10: @load policy/protocols/smb. This should be backward compatible with older versions of Bro/Zeek. But if you are getting @laod SMB errors, you could try changing line 10 to this: @load base/protocols/smb. Mark _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
smime.p7s
(application/pkcs7-signature, 4.9 KB) - not displayed