Re: Creating a module and accessing an event in another script
Merril Mathew <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hi Justin, Thank you for the script, much appreciated. Unfortunately it does not seem to solve the problem, now I am starting to think if there is any issue with my zeek installation. Also apologies for the messy code. I am only one week into Zeek(bro) and I will try to improve the code for any future posts. :) Kind regards, Merril. > On 5 Jun 2019, at 18:39, Justin Azoff <[email protected]> wrote: > > that script should generally work, but it was a lot more complicated than it needed to be to accomplish what you are trying to do. Here is a much simplified version. > > The only thing to keep in mind is that since you are using zeek_init to setup the log stream this won't work on bro or a small number of zeek builds from right after the rename. There are no released versions of zeek so I don't know when you built it. Using bro_init is backwards compatible and is probably better for now. > > On Wed, Jun 5, 2019 at 12:46 PM Merril Mathew <[email protected] <mailto:[email protected]>> wrote: > Hi Justin, > > I can confirm that attached scripts does not send me email on live traffic or create a log under $PREFIX/logs/current. But it does create notice.log and a SSHAttempt.log when running pcap. I can also confirm that send mail set up is working as I have received emails from zeek from other scripts. > > Kind regards, > Merril. > > > >> On 5 Jun 2019, at 17:20, Justin Azoff <[email protected] <mailto:[email protected]>> wrote: >> >> On Wed, Jun 5, 2019 at 12:11 PM Merril Mathew <[email protected] <mailto:[email protected]>> wrote: >> Hi Justin, >> >> Thanks. But it did not work for me. >> >> Did not work how? Did you post the version of the script that didn't work? >> >> -- >> Justin > > > > -- > Justin > <main.zeek> _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek