How to enrich conn logs through a CSV file?

I am currently learning Zeek scripting, and I want to enrich Zeek’s conn logs using a CSV file. I referred to this code: GitHub - abousteif/Conn-Zeek-enrichment: Enrich Conn log with input file matches. Pretty much copied justin's script :) and modified slightly, but the enrichment_table is always empty. I tried adding the Input::end_of_data event, only to find that the Input::end_of_data event always runs after the connection_state_remove event, so it doesn’t work. I want to know what I should do now to modify it? Where should I go to learn about these?"

event zeek_init()
# Add additional conn fields based on input framework
#Extending the conn.log - adding the following field to the record (conn info is what is logged)
redef record Conn::Info += {
	Reputation: Val &log &optional;

#The event that will be used to observe all the connections
event connection_state_remove(c: connection)
	if ( c$id$resp_h in Connenrichment_table ){

That sound like you’re testing this using zeek -r to process a PCAP. If so, processing of the packets might already been done once your file is read. To pause processing until your file is loaded you can use suspend_processing() and continue_processing(). You can find examples in some of Zeek’s tests:


Thank you very much, it is working now.