files.log

Zeek
1

Hi ,
This method can we add id into files.log

global myevent: event(f: fa_file, c: connection, is_orig: bool);

redef record Files::Info += {

tx_cc: string &log &optional;

#rx_cc: string &log &optional;

#tx_asn: count &log &optional;
#rx_asn: count &log &optional;
id: conn_id &log &optional;
};

event myevent(f: fa_file, c: connection, is_orig: bool) &priority = -10
{
if ( ! f?$info )
return;

f$info$id = c$id;

}

Regards,
Sunub

event bro_init()
{

event myevent( f: fa_file, c: connection, is_orig: bool);

}

event bro_done()
{
print “bro_done()”;
}

2

Not sure what you would like to log extra in files.log, but files.log already has a conn_uids field as well as src and dest IPs.
conn id is a four tuple, and only things missing in files.log with regard to conn$id are ports (orig_p and resp_p), other then these
two fields files.log has pretty much everything you might be interested in.

Or, I might have mis-understood the question. :slight_smile:

-Fatema.