Re: Zeek - Usecase based File Extraction
Jan Grashöfer <[email protected]> Fri, 13 Sep 2019 17:54:59 +0200
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
Hi Bart, On 12/09/2019 21:40, Uton Cyr wrote: > A few questions: > - Is it possible to extract a file during an Intel::match event? > ... usually the match is too late to attach the file analyzer that handles extraction. Furthermore, in a cluster setup its triggered on the manager. The simplest way to get files for intel hits is to extract all files and just preserve the ones that triggered a hit (for the poor man's approach see https://github.com/J-Gras/intel-extensions/blob/master/scripts/preserve_files.bro). Jan _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek