Does `files.log` generator recognize application/json file types, and if
not, what could I modify to get that to work? What does the generator
key into to make the decision?
It does not. Unfortunately JSON detection would be pretty difficult and fraught with false positives. If you have a regex that you’d like to suggest for matching JSON I’m sure some people could try it and we could find out if it’s resilient enough.
With Bro 2.3+ you can write your own file signatures that you can load in to try and sniff file mime types.
.Seth