Re: Bro -r using multiple PCAP
David Decker <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAE44EXE4D3X9+Lo_GGWBi7-T47HMYua+nCSavdWr+B_qwyBo7g@mail.gmail.com> |
Update on the Bro -r using multiple scripts. I guess I should add that I am needing to break out the logs (either by PCAP or by say day) not sure what is the easiest. Thanks everyone so far. Still working out the kinks i guess. New to this. On Mon, Apr 29, 2019 at 1:57 PM David Decker <[email protected]> wrote: > Looking to see if anyone has created a script, or if this is an argument > to process multiple PCAPS using the bro -r argument. > > I have it setup to output to JSON currently and change from EPOCH time to > normal date/time output, but that is one at a time, and will have > multiple. > > Looking at either a batch script of maybe python but wanted to see if > anyone has done this bfore. > (Reingest multiple old PCAP files) to get re-ingested. > > Dave > _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek