# An assist with file extraction **URL:** \ **Category:** Zeek\ **Created:** [April 16, 2015, 11:55am UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561 "2015-04-16T11:55:44Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [April 16, 2015, 11:55am UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/1 "2015-04-16T11:55:44Z")
Hey all, The topic pretty much says it…I’ve done a fair amount of reading trying to determine the best way to extract file attachments in smtp traffic. Most of the information I’ve found is related to older versions of bro. Can someone point me to a current resource that will work with the current version of bro? Thank you. James ---
**Author:** ![Hosom\_Stephen\_M](https://avatars.discourse-cdn.com/v4/letter/h/d26b3c/32.png) [@Hosom\_Stephen\_M](https://community.zeek.org/u/Hosom_Stephen_M)\ **Post date:** [April 16, 2015, 1:04pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/2 "2015-04-16T13:04:40Z")
For 2.3.2 (current release) you’ll want to use the event file\_new. Note that in 2.3.2 if you are extracting based on mime\_type (most people do) you will want to verify that the field exists before you actually use it. For master, which is what you are likely referring to… you’ll want the event file\_mime\_type. ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [April 17, 2015, 5:26pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/3 "2015-04-17T17:26:52Z")
For 2.3.2 (current release) you’ll want to use the event file\_new. Note that in 2.3.2 if you are extracting based on mime\_type (most people do) you will want to verify that the field exists before you actually use it. For master, which is what you are likely referring to… you’ll want the event file\_mime\_type. ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [April 17, 2015, 5:40pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/4 "2015-04-17T17:40:30Z")
Well here’s what I have: global ext\_map: table[string] of string = { [“application/x-dosexec”] = “exe”, [“application/zip”] = “zip”, [“application/msword”] = “xls”, }; event file\_new(f: fa\_file) { if ( f$source != “SMTP” ) return; if ( ! f?$mime\_type || f$mime\_type !in ext\_map ) return; local ext = “”; if ( f?$mime\_type ) ext = ext\_map[f$mime\_type]; local fname = fmt("%s-%s.%s", f$source, f$id, ext); Files::add\_analyzer(f, Files::ANALYZER\_EXTRACT, [$extract\_filename=fname]); } This appears to function ok…Office doc XML format end up as zips, which is fine by me. Can anyone see anything glaringly wrong with this? Also…I have bro log files zipped and rotated at midnight…is there a way to include the extract\_files directory in that rotation, or, even better, have the extracted files go into a directory name with say something like /mnt/backup/extract\_files/04-16-16 and change per day? Thank you. James ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [April 17, 2015, 8:20pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/5 "2015-04-17T20:20:57Z")
> This appears to function ok....Office doc XML format end up as zips, which is fine by me. This will be fixed in 2.4. New xml Office files will be identified as.... application/vnd.openxmlformats-officedocument.presentationml.presentation application/vnd.openxmlformats-officedocument.spreadsheetml.sheet application/vnd.openxmlformats-officedocument.wordprocessingml.document and... application/vnd.openxmlformats-officedocument in case a better option wasn’t discovered. And, yes, those are the \*actual\* mime types for MS Office documents. > Also...I have bro log files zipped and rotated at midnight..is there a way to include the extract\_files directory in that rotation, or, even better, have the extracted files go into a directory name with say something like /mnt/backup/extract\_files/04-16-16 and change per day? Please feel free to file a ticket. That would be a nice trick. 🙂   [http://tracker.bro.org](http://tracker.bro.org)   .Seth ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [April 17, 2015, 8:25pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/6 "2015-04-17T20:25:35Z")
I will file...looks like I'll have to 'roll my own' for the archiving. Thank you. James ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [April 17, 2015, 8:40pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/7 "2015-04-17T20:40:59Z")
And one last bit....could I theoretically redef extract\_files? share/bro/base/files/extract/main.bro: const prefix = "./extract\_files/" &redef; I could always symlink that directory to a different drive but eh....the more I can shove into the script the better. Thanks again. James ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/an-assist-with-file-extraction/3561/8 "2022-05-06T15:42:36Z")