Hi, I am trying to create a script that reads information from a file and compares it with the information obtained in the traffic. The file is a .csv and its data is used to fill a table created in the scope of the script using the Input framework.
One of the columns of the file contains hashes values and the main objective is to compare them to the hashes values obtained in traffic when a download is made. When a malware which hash is contained in the file is downloaded, the script should create a log with informations about the connection through which the download was made.
However, I am having difficulties in the process of creating a log in this context. When I call the creation of a log in the Input::end_of_data event, the table data is shown, but the this does not happen when I do the same in the file_hash event.
I am attaching a .zip file which contains the script that I am developing, the .csv file mentioned, and also the .cap file I used to test the script and a .md with some more informations about this process.
I would be grateful if you could help me with this issue 
zeek_hashes.zip (6.7 KB)