Alarms in log vs alarms in report

Zeek
1

Hi,

I have noticed that Bro can provide the user with a fine grained classification
of alarms in the reports (likely unsuccessful, likely successful, ...).
However, in the log, Bro provides me with a less specific classification (alarm
vs no alarm) with no indication of the potential success (or failure) of the
attack. I think that the events in the log correspond to likely successful
attacks only (correct me if I am wrong).

I am wondering if there is any way to get Bro to output all events in the log
WITH their classification (likely successful, likely unsuccessful, ...) or if
this feature is reserved specifically for reports ?

Thank you very much!

2

The "likely successful, likely unsuccessful, etc" categories are generated
by the report generation script, based on whether or not there
are subsequent successful connections to the same host. So there
is no easy way to do this in the logs.