Hi Vern,
Sorry it took so long to reply, I tried to use zeek’s cmd to run some scripted directly, the SSH related event was successfully raised. Howerver, when I used the zeekctl and deployed the scripts, they acted like what I said before. I read the zeekctl.cfg already but couldn’t find any reasons related. What could be wrong with this?