R: signature update without restarting zeek
Palumbo Mauro <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hi Christopher, I am aware of the input framework feature REREAD and in fact I already used it for other files. However, it is my understanding that this cannot be used for signatures files. But I'll be glad to be wrong on this point... :-) Thanks Mauro -----Messaggio originale----- Da: Christopher M. Hobbs [mailto:[email protected]] Inviato: mercoledì 7 agosto 2019 18:04 A: Palumbo Mauro <[email protected]> Cc: [email protected] Oggetto: Re: [Zeek] signature update without restarting zeek On 8/7/19 10:38 AM, Palumbo Mauro wrote: > Hi everybody, > > I think it would be nice to be able to update a user-defined > signature file without restarting zeek, possibly using the input > framework. Hello, Palumbo! I'm not sure about the rule parsing but it might help to know that the input framework is capable of re-reading files: https://docs.zeek.org/en/stable/frameworks/input.html#re-reading-and-streaming-data Sorry if that's not much help, it's just a recent feature that I came across that may be useful to you. Regards, cmh _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek