# http-identified-files.bro

**URL:** <https://community.zeek.org/t/http-identified-files-bro/1409>\
**Category:** Zeek\
**Created:** [October 17, 2008, 1:50am UTC](https://community.zeek.org/t/http-identified-files-bro/1409 "2008-10-17T01:50:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CS\_Lee](https://avatars.discourse-cdn.com/v4/letter/c/35a633/32.png) [@CS\_Lee](https://community.zeek.org/u/CS_Lee)\
**Post date:** [October 17, 2008, 1:50am UTC](https://community.zeek.org/t/http-identified-files-bro/1409/1 "2008-10-17T01:50:44Z")

</div>

hi seth,

In http transaction, some of the executable files are transfer via this mime type -

application/octet-stream

I have appended it for watched\_mime\_types in http-identified-files.bro and it works fine.

Cheers ;]

---

<div class="post-metadata">

**Author:** ![Seth\_Hall](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Seth\_Hall](https://community.zeek.org/u/Seth_Hall)\
**Post date:** [October 17, 2008, 2:42am UTC](https://community.zeek.org/t/http-identified-files-bro/1409/2 "2008-10-17T02:42:01Z")

</div>

You might want to check the description for those files. There are a lot of other files that are identified as octet-streams, or at least as far as I can remember when I was working on that script a while ago. 🙂

&nbsp;&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/http-identified-files-bro/1409/3 "2022-05-06T15:38:42Z")

</div>