# Converting fa\_file to file\_sniff

**URL:** <https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697>\
**Category:** Zeek\
**Created:** [July 9, 2015, 8:07pm UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697 "2015-07-09T20:07:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [July 9, 2015, 8:07pm UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697/1 "2015-07-09T20:07:56Z")

</div>

So per:

[https://www.bro.org/download/NEWS.bro.html](https://www.bro.org/download/NEWS.bro.html)

"Removed fa\_file record’s mime\_type and mime\_types fields. The event file\_sniff has been added which provides the same information. The mime\_type field of Files::Info also still has this info."

I have a script...smtp-file-extract.bro:

global ext\_map: table[string] of string = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["application/x-dosexec"] = "exe",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["application/zip"] = "zip",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["application/msword"] = "xls",  
};

event file\_new(f: fa\_file)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( f$source != "SMTP" )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( ! f?$mime\_type || f$mime\_type !in ext\_map )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local ext = "";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( f?$mime\_type )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ext = ext\_map[f$mime\_type];

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local fname = fmt("%s-%s.%s", f$source, f$id, ext);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Files::add\_analyzer(f, Files::ANALYZER\_EXTRACT, [$extract\_filename=fname]);  
}

which while not perfects gets what I need done. This is now broken with 2.4, as expected, however I'm at a loss on how to fix this. Again, per the NEWS link above:

"The earliest point that new mime type information is available is in the file\_sniff event which comes after the file\_new and file\_over\_new\_connection events. Scripts which inspected mime type info within those events will need to be adapted. (Note: for users that worked w/ versions of Bro from git, for a while there was also an event called file\_mime\_type which is now replaced with the file\_sniff event)."

Awesome. How do I adapt this? Not sure where to look for changing this. Thank you.

James

---

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [July 9, 2015, 8:13pm UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697/2 "2015-07-09T20:13:20Z")

</div>

James,

Take a look at this script, it's almost identical to yours:  
[https://github.com/bro/bro/blob/2b1cd66f17194a30b90490965cbdffdd71c18c09/doc/httpmonitor/file\_extraction.bro](https://github.com/bro/bro/blob/2b1cd66f17194a30b90490965cbdffdd71c18c09/doc/httpmonitor/file_extraction.bro)

Josh

---

<div class="post-metadata">

**Author:** ![Doug\_Burks](https://avatars.discourse-cdn.com/v4/letter/d/ee7513/32.png) [@Doug\_Burks](https://community.zeek.org/u/Doug_Burks)\
**Post date:** [July 9, 2015, 8:17pm UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697/3 "2015-07-09T20:17:51Z")

</div>

Hi James,

Here's how I adapted a similar script:  
[https://github.com/Security-Onion-Solutions/securityonion-bro-scripts/blob/master/file-extraction/extract.bro](https://github.com/Security-Onion-Solutions/securityonion-bro-scripts/blob/master/file-extraction/extract.bro)

---

<div class="post-metadata">

**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\
**Post date:** [July 9, 2015, 9:05pm UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697/4 "2015-07-09T21:05:20Z")

</div>

Thanks Gents...appreciate the fast help. For those keeping score at home here's what works:

global ext\_map: table[string] of string = {  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["application/x-dosexec"] = "exe",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["application/zip"] = "zip",  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;["application/msword"] = "xls",  
};

event file\_sniff(f: fa\_file, meta: fa\_metadata)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( f$source != "SMTP" )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( ! meta?$mime\_type || meta$mime\_type !in ext\_map )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return;

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local ext = "";

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if ( meta?$mime\_type )  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ext = ext\_map[meta$mime\_type];

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;local fname = fmt("%s-%s.%s", f$source, f$id, ext);  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Files::add\_analyzer(f, Files::ANALYZER\_EXTRACT, [$extract\_filename=fname]);  
}

Have to say I would have never figured this out just by reading the Bro documentation....thanks to you both again.

James

---

<div class="post-metadata">

**Author:** ![Ricky\_Chapman](https://avatars.discourse-cdn.com/v4/letter/r/848f3c/32.png) [@Ricky\_Chapman](https://community.zeek.org/u/Ricky_Chapman)\
**Post date:** [July 14, 2015, 12:46am UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697/5 "2015-07-14T00:46:42Z")

</div>

Perfect! Exactly what I was looking for. Thank you all!!

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/converting-fa-file-to-file-sniff/3697/6 "2022-05-06T15:42:50Z")

</div>