Issues with Intel::FILE_NAME not working.

Zeek
1

Using the Intel Framework I cannot get Intel::FILE_NAME to fire. It
is working with any other type so my script and read file is good.

I am loading the following scripts

Policy/frameworks/intel/seen
policy/frameworks/intel/do_notice
frameworks/file/hash-all-files.bro
base/frameworks/intel/files.bro

Loading hash-all-files.bro is there so that Intel::FILE_HASH works, is
there a better way?

I am taking filenames from both my files.log and http.log files so I
know the files exist. I am getting no errors in recorder.log and am
running from the command line and no errors are there. Any ideas on
what I am doing wrong?

2

Hi William,

the script seen/file-names.zeek [1] defines how file names are reported to the intel framework. To match, the indicator has to be identical to f$info$filename.

Jan

[1] https://github.com/zeek/zeek/blob/master/scripts/policy/frameworks/intel/seen/file-names.zeek