| Newsgroups |
gmane.comp.security.detection.bro |
| Message-ID |
<[email protected]> |
--===============1716078299==
Content-Type: multipart/alternative;
boundary="Apple-Mail=_CD1BC350-5E50-4360-A8DC-1F9CBE1E08E7"
--Apple-Mail=_CD1BC350-5E50-4360-A8DC-1F9CBE1E08E7
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
Hi Carlos,
=E2=80=9CBest=E2=80=9D is subjective. For someone who wants all logs =
and a short inputs.conf file, your suggestion will work. My example is =
geared towards the fact that these logs are large and depending on your =
Splunk license and requirements, you may not actually want to ingest =
every single log file into your system. Ultimately, you know your =
environment and needs best which is why I also state in the writeup:
"An example inputs.conf is below but may or may not include the logs you =
wish to ingest...Modify the index and sourcetype configurations to your =
needs.=E2=80=9D
Hope that helps!
Eric
> On Dec 20, 2019, at 8:22 AM, Carlos Lopez <[email protected]> wrote:
>=20
> Thanks Eric. But I have doubt with your setup. For inputs.conf, maybe =
this configuration is best?
> =20
> [monitor:///opt/zeek/logs/spool/current =
<monitor:///opt/zeek/logs/spool/current>]
> disabled =3D 0
> sourcetype =3D zeek:json
> whitelist =3D \.log$
> =20
> instead of to put file by file?
> --=20
> Regards,
> C. L. Martinez
> =20
> From: Eric Ooi <[email protected]>
> Date: Friday, 20 December 2019 at 13:52
> To: Amber Graner <[email protected]>, Carlos Lopez =
<[email protected]>
> Cc: "[email protected]" <[email protected]>
> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek
> =20
> Assuming you=E2=80=99re doing an install on a standalone Splunk =
server, you can use my guide here: =
https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-bro-logs-t=
o-splunk/
> =20
> =20
> From: [email protected] on behalf of Amber Graner =
<[email protected]>
> Sent: Friday, December 20, 2019 6:13 AM
> To: Carlos Lopez
> Cc: [email protected]
> Subject: Re: [Zeek] Documentation about Corelight's Splunk Apps for =
Zeek=20
> =20
> Hi Carlos,=20
> =20
> As that is a Corelight offering and not something maintained by the =
Zeek Project or the community, we=E2=80=99d have to refer you to =
Corelight.
> =20
> Let me find out who you need to talk to and I=E2=80=99ll make =
introductions.=20
> =20
> Thanks,
> ~Amber=20
> =20
> On Fri, Dec 20, 2019 at 3:56 AM Carlos Lopez <[email protected] =
<mailto:[email protected]>> wrote:
> Hi all,
> =20
> I would like to install Corelight App For Splunk and TA for Corelight, =
but there is no documentation about how to accomplish it =E2=80=A6 All =
info points tohttps://www.corelight.com/support/ =
<https://www.corelight.com/support/>, but there is no docs in there =E2=80=
=A6
> =20
> Any idea?
> =20
> =20
> --=20
> Regards,
> C. L. Martinez
> _______________________________________________
> Zeek mailing list
> [email protected] <mailto:[email protected]>
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek =
<http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek>
> --=20
> =20
> Amber Graner
> Director of Community
> Corelight, Inc
> =20
> 828.582.9469
> =20
> Schedule time on my calendar here. <https://calendly.com/amber_graner>
> =20
> =20
> =20
> * Ask me about how you can participate in the Zeek (formerly Bro) =
community.
> * Remember - ZEEK AND YOU SHALL FIND!!
--Apple-Mail=_CD1BC350-5E50-4360-A8DC-1F9CBE1E08E7
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><div =
class=3D"">Hi Carlos,</div><div class=3D""><br class=3D""></div><div =
class=3D"">=E2=80=9CBest=E2=80=9D is subjective. For someone who =
wants all logs and a short inputs.conf file, your suggestion will work. =
My example is geared towards the fact that these logs are large =
and depending on your Splunk license and requirements, you may not =
actually want to ingest every single log file into your system. =
Ultimately, you know your environment and needs best which is why =
I also state in the writeup:</div><div class=3D""><br =
class=3D""></div><div class=3D"">"An example inputs.conf is below but =
may or may not include the logs you wish to ingest...Modify the index =
and sourcetype configurations to your needs.=E2=80=9D</div><div =
class=3D""><br class=3D""></div><div class=3D"">Hope that =
helps!</div><div class=3D"">Eric</div><div class=3D""><br =
class=3D""></div><div class=3D""><div><blockquote type=3D"cite" =
class=3D""><div class=3D"">On Dec 20, 2019, at 8:22 AM, Carlos Lopez =
<<a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>> wrote:</div><br =
class=3D"Apple-interchange-newline"><div class=3D""><div =
class=3D"WordSection1" style=3D"page: WordSection1; caret-color: rgb(0, =
0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; =
font-variant-caps: normal; font-weight: normal; letter-spacing: normal; =
text-align: start; text-indent: 0px; text-transform: none; white-space: =
normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; =
text-decoration: none;"><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D"">Thanks Eric. But I have doubt with your setup. =
For inputs.conf, maybe this configuration is best?<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""><o:p class=3D""> </o:p></span></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" style=3D"font-size: =
10pt; font-family: "Courier New";" class=3D"">[<a =
href=3D"monitor:///opt/zeek/logs/spool/current" style=3D"color: blue; =
text-decoration: underline;" =
class=3D"">monitor:///opt/zeek/logs/spool/current</a>]<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" style=3D"font-size: 10pt; font-family: "Courier =
New";" class=3D"">disabled =3D 0<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" style=3D"font-size: 10pt; font-family: "Courier =
New";" class=3D"">sourcetype =3D zeek:json<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" style=3D"font-size: 10pt; font-family: "Courier =
New";" class=3D"">whitelist =3D \.log$<o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""><o:p class=3D""> </o:p></span></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">instead =
of to put file by file?<o:p class=3D""></o:p></span></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">-- <o:p class=3D""></o:p></span></div><div class=3D""><div=
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">Regards,<o:p class=3D""></o:p></span></div></div></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">C. L. =
Martinez</span><span lang=3D"EN-US" class=3D""><o:p =
class=3D""></o:p></span></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""><o:p class=3D""> </o:p></span></div><div =
style=3D"border-style: solid none none; border-top-width: 1pt; =
border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm;" =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><b class=3D""><span =
style=3D"font-size: 12pt;" class=3D"">From:<span =
class=3D"Apple-converted-space"> </span></span></b><span =
style=3D"font-size: 12pt;" class=3D"">Eric Ooi <<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>><br =
class=3D""><b class=3D"">Date:<span =
class=3D"Apple-converted-space"> </span></b>Friday, 20 December =
2019 at 13:52<br class=3D""><b class=3D"">To:<span =
class=3D"Apple-converted-space"> </span></b>Amber Graner <<a =
href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>>, Carlos Lopez <<a =
href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>><br class=3D""><b class=3D"">Cc:<span=
class=3D"Apple-converted-space"> </span></b>"<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>" <<a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>><br =
class=3D""><b class=3D"">Subject:<span =
class=3D"Apple-converted-space"> </span></b>Re: [Zeek] =
Documentation about Corelight's Splunk Apps for Zeek<o:p =
class=3D""></o:p></span></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div></div><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Assuming you=E2=80=99re doing an install on a standalone =
Splunk server, you can use my guide here: <a =
href=3D"https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek-br=
o-logs-to-splunk/" =
class=3D"">https://www.ericooi.com/zeekurity-zen-part-iii-how-to-send-zeek=
-bro-logs-to-splunk/</a><o:p class=3D""></o:p></div></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> <o:p =
class=3D""></o:p></div></div><div class=3D"MsoNormal" align=3D"center" =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif; text-align: center;"><hr size=3D"0" width=3D"100%" =
align=3D"center" class=3D""></div><div id=3D"divRplyFwdMsg" =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><b class=3D"">From:</b><span=
class=3D"Apple-converted-space"> </span><a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a>=
on behalf of Amber Graner <<a href=3D"mailto:[email protected]" =
class=3D"">[email protected]</a>><br class=3D""><b =
class=3D"">Sent:</b><span =
class=3D"Apple-converted-space"> </span>Friday, December 20, 2019 =
6:13 AM<br class=3D""><b class=3D"">To:</b><span =
class=3D"Apple-converted-space"> </span>Carlos Lopez<br class=3D""><b=
class=3D"">Cc:</b><span class=3D"Apple-converted-space"> </span><a =
href=3D"mailto:[email protected]" class=3D"">[email protected]</a><br =
class=3D""><b class=3D"">Subject:</b><span =
class=3D"Apple-converted-space"> </span>Re: [Zeek] Documentation =
about Corelight's Splunk Apps for Zeek<span =
class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""> <o:p class=3D""></o:p></div></div></div><div =
class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D"">Hi =
Carlos, <o:p class=3D""></o:p></div></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">As that is a Corelight offering and not something maintained =
by the Zeek Project or the community, we=E2=80=99d have to refer you to =
Corelight.<o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Let me find out who you need to talk to and I=E2=80=99ll make =
introductions. <o:p class=3D""></o:p></div></div><div class=3D""><div=
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Thanks,<o:p class=3D""></o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">~Amber <o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D"">On Fri, Dec 20, 2019 at =
3:56 AM Carlos Lopez <<a href=3D"mailto:[email protected]" =
style=3D"color: blue; text-decoration: underline;" =
class=3D"">[email protected]</a>> wrote:<o:p =
class=3D""></o:p></div></div><blockquote style=3D"border-style: none =
none none solid; border-left-width: 1pt; border-left-color: rgb(204, =
204, 204); padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: =
0cm;" class=3D""><div class=3D""><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D"">Hi all,</span><o:p =
class=3D""></o:p></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><o:p class=3D""></o:p></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">I would =
like to install Corelight App For Splunk and TA for Corelight, but there =
is no documentation about how to accomplish it =E2=80=A6 All info points =
to</span><a href=3D"https://www.corelight.com/support/" target=3D"_blank" =
style=3D"color: blue; text-decoration: underline;" class=3D""><span =
lang=3D"EN-US" =
class=3D"">https://www.corelight.com/support/</span></a><span =
lang=3D"EN-US" class=3D"">, but there is no docs in there =E2=80=A6</span>=
<o:p class=3D""></o:p></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D""> </span><o:p class=3D""></o:p></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">Any =
idea?</span><o:p class=3D""></o:p></div></div></div><div class=3D""><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D""> </span><o:p class=3D""></o:p></div><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><span lang=3D"EN-US" class=3D""> </span><o:p =
class=3D""></o:p></div><div style=3D"margin: 0cm 0cm 0.0001pt; =
font-size: 11pt; font-family: Calibri, sans-serif;" class=3D""><span =
lang=3D"EN-US" class=3D"">-- </span><o:p class=3D""></o:p></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" =
class=3D"">Regards,</span><o:p class=3D""></o:p></div></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><span lang=3D"EN-US" class=3D"">C. L. =
Martinez</span><o:p class=3D""></o:p></div></div></div><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" =
class=3D"">_______________________________________________<br =
class=3D"">Zeek mailing list<br class=3D""><a =
href=3D"mailto:[email protected]" target=3D"_blank" style=3D"color: blue; =
text-decoration: underline;" class=3D"">[email protected]</a><br class=3D""><a=
href=3D"http://mailman.icsi.berkeley.edu/mailman/listinfo/zeek" =
target=3D"_blank" style=3D"color: blue; text-decoration: underline;" =
class=3D"">http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek</a><o:p =
class=3D""></o:p></div></blockquote></div></div><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">--<span class=3D"Apple-converted-space"> </span><o:p =
class=3D""></o:p></div><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div class=3D""><div =
class=3D""><div class=3D""><div class=3D""><div style=3D"margin: 0cm 0cm =
0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><b class=3D"">Amber Graner</b><o:p =
class=3D""></o:p></div></div><div class=3D""><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D"">Director of Community<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Corelight, Inc<o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">828.582.9469<o:p class=3D""></o:p></div></div><div =
class=3D""><div style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; =
font-family: Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D"">Schedule time on my calendar<span =
class=3D"Apple-converted-space"> </span><a =
href=3D"https://calendly.com/amber_graner" target=3D"_blank" =
style=3D"color: blue; text-decoration: underline;" =
class=3D"">here.</a><o:p class=3D""></o:p></div></div><div class=3D""><div=
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""><o:p =
class=3D""> </o:p></div></div><div class=3D""><div style=3D"margin: =
0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""> <span style=3D"border: 1pt solid windowtext; =
padding: 0cm;" class=3D""><img border=3D"0" width=3D"96" height=3D"30" =
id=3D"_x0000_i1026" src=3D"cid:~WRD0001.jpg" alt=3D"Image removed by =
sender." style=3D"width: 1in; height: 0.3125in;" =
class=3D""></span> <span style=3D"border: 1pt solid windowtext; =
padding: 0cm;" class=3D""><img border=3D"0" width=3D"96" height=3D"39" =
id=3D"_x0000_i1025" src=3D"cid:~WRD0001.jpg" alt=3D"Image removed by =
sender." style=3D"width: 1in; height: 0.4062in;" class=3D""></span><o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""><o:p class=3D""> </o:p></div></div><div class=3D""><div =
style=3D"margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: =
Calibri, sans-serif;" class=3D""> * Ask me about how you can =
participate in the Zeek (formerly Bro) community.<o:p =
class=3D""></o:p></div></div><div class=3D""><div style=3D"margin: 0cm =
0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" =
class=3D""> * Remember - ZEEK AND YOU SHALL =
FIND!!</div></div></div></div></div></div></div></div></div></div></div></=
div></div></div></blockquote></div><br class=3D""></div></body></html>=
--Apple-Mail=_CD1BC350-5E50-4360-A8DC-1F9CBE1E08E7--
--===============1716078299==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============1716078299==--