Hello all. I am trying to extract cookie key/value pairs with bro. Bro 2.1 out of the box comes with /usr/local/bro/share/bro/policy/protocols/http/var-extraction-cookies.bro that extracts only the keys. Below is the baked in way of keys and I’m looking for something similar for the values. I would rather use something that is already there if it exists but cannot find it.
If it does not exist, what would be the recommendation for creating it? My understanding is that modifying anything outside of /usr/local/bro/share/bro/site can get overwritten with updates. Should I create a whole new protocols/http directory structure under /usr/local/bro/share/bro/site and keep the configuration of cookies separate?