I’m testing to see if c$service is a subset of a set[string] field in a table, and getting the error message
“error in string and ./bro_scripts/Screen_protocols.bro, line 79: type clash (string and Screen_protocols::c$service)
error in ./bro_scripts/Screen_protocols.bro, line 79 and string: type mismatch (Screen_protocols::c$service and string)
error in ./bro_scripts/Screen_protocols.bro, line 79: not an index type (Screen_protocols::c$service in Screen_protocols::whitelist[Screen_protocols::c$id$orig_h, Screen_protocols::c$id$resp_h]$service)”
The command is: “if (c$service !in whitelist[c$id$orig_h, c$id$resp_h]$service)”
Where the table is defined as “global whitelist: table[addr, addr] of Service_whitelist_data = table();” and the table field service is defined as “service: set[string];”
Please advise!
Best Regards,
Earl Eiland,
Sr. Cyber Security Engineer,
Emerging Technologies, root9B,
San Antonio, Texas