Re: - EXEC framework - run command

william de ping <[email protected]>
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAKZA8xgsH686cfBeZeS4wt3v2FSq8pUkKPjoacW38cg-hF72zw@mail.gmail.com>
Never mind, Ive just seen the unlink command :)

On Tue, Jun 25, 2019 at 2:35 PM william de ping <[email protected]>
wrote:

> Thank you, that solves one issue I have.
> In case I would like to rm the file, I would have to use the EXEC
> framework, correct ?
>
> On Mon, Jun 24, 2019 at 5:20 PM Justin Azoff <[email protected]> wrote:
>
>> There's no need to use exec for this as there is a rename bif now.  I
>> sent a PR to update this:
>>
>> https://github.com/hosom/file-extraction/pull/10/files
>>
>> On Mon, Jun 24, 2019 at 7:34 AM william de ping <[email protected]>
>> wrote:
>> >
>> > Hi everyone,
>> >
>> > I'm trying to run the following script :
>> >
>> https://github.com/hosom/file-extraction/blob/master/scripts/plugins/store-files-by-md5.bro
>> >
>> > The issue is that the EXEC::run command is not working as expected.
>> > I run bro on a pcap file, in debug.log I see that a thread was
>> initiated and finished with no issues, however the file is not moved..
>> >
>> > Any ideas ?
>> >
>> > Thank you
>> > B
>> > _______________________________________________
>> > Zeek mailing list
>> > [email protected]
>> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
>>
>>
>>
>> --
>> Justin
>>
>

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.