Re: New Analyzer
Justin Azoff <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAPfnCuh4ut=_XAhdOXW0bjhaaRxGNCkRcQgKWsC=U6rEJkGW+Q@mail.gmail.com> |
Oh, looking at this closer you probably want to use zeek/aux/zeek-aux/plugin-support/init-plugin to create the plugin skeleton. the binpac quickstart I think is a bit out of date at this point for how to setup an external plugin+package. The binpac parts it genrates should still be fine though. so I would use init-plugin to make a new package and copy your existing code over it. that should give you a working self-contained external package that you can install. It also takes advantage of the new bro-config bits which make building and installing the plugin work without the full source checkout. On Wed, Jul 10, 2019 at 8:51 PM Justin Azoff <[email protected]> wrote: > > did you run that with --plugin? > > On Wed, Jul 10, 2019 at 8:39 PM Aaron Heller <[email protected]> wrote: > > > > Hi Justin, > > I started off using the binpac_quickstart script, which I thought created an external plugin? > > > > Thanks, > > Aaron > > > > On Wed, Jul 10, 2019 at 8:20 PM Justin Azoff <[email protected]> wrote: > >> > >> On Wed, Jul 10, 2019 at 8:16 PM Aaron Heller <[email protected]> wrote: > >>> > >>> Maybe that and the analyzer not automatically firing off indicates an issue with the bacnet script not being called appropriately? I'm grasping at straws, so any thoughts are greatly appreciated! > >> > >> > >> I don't think you are loading the scripts at all.. which is also why the sigs aren't loaded. > >> > >> Are you building this as an in-tree analyzer or as an external plugin? > >> > >> -- > >> Justin > > > > -- > Justin -- Justin _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek