Intel Framework Issues

Zeek
1

Hi,

The one thing that’s not working really - is EMAIL indicators.
On my previous installation it worked well (2.2), but after that it broke.
You can easily test it in http://try.bro.org/ (just upload your own pcap file with smtp connection).
Somebody pointed here this issue early this year, but it is still not resolved.

Regards,
Audrius

2

Hi,

I like the idea of using the $where, because it was the first thing that came to my mind, too. We just need to make sure that the behavior is well documented.

Regards,

Jan

P.S.: I’ve already opened a ticket for the mail issue (https://bro-tracker.atlassian.net/browse/BIT-1507).

3

Thanks a lot!

Regards,
Audrius