Creating a module and accessing an event in another script

Hi all,

I am new to Zeek and would like some help with writing a module and
accessing the events in another script.

I created a module called SSHAttempt under /usr/local/bro/share/bro/site
and set up the module with __local__.zeek and main.zeek.

I created a custom log stream based on the result derived from
ssh_auth_result in SSHAttempt/main.zeek. I also exported the SSH::Info
record as log_sshattempt from main.zeek.

I can see the notice.log when running with sshquess.pcap. However if I try
to access the event that has been exported from SSHAttempt/main.zeek inside
another script (test.zeek) then I am getting the error that the record
values are not initialised. I was expecting auth_fail variable inside
SSHAttempt::Info record to be initialised when running .pcap.

Please find all the necessary files for reference. Any help would be much
appreciated. :)

Kind regards,
Merril

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek