Issues with Intel::FILE_NAME not working.
William Dieterich <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CALJ0rXwR2o-pfOAMm4ovNZTmYD7UKBWWKtVmOyzrXAYhTxnbuQ@mail.gmail.com> |
Using the Intel Framework I cannot get Intel::FILE_NAME to fire. It is working with any other type so my script and read file is good. I am loading the following scripts Policy/frameworks/intel/seen policy/frameworks/intel/do_notice frameworks/file/hash-all-files.bro base/frameworks/intel/files.bro Loading hash-all-files.bro is there so that Intel::FILE_HASH works, is there a better way? I am taking filenames from both my files.log and http.log files so I know the files exist. I am getting no errors in recorder.log and am running from the command line and no errors are there. Any ideas on what I am doing wrong? _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek