Hello,
I was just wondering if it was possible to lookup fa_file or Files::Info records given a FUID. I have been looking through the built in functions but have not seen anything.
Best,
Jereme Lamps
Hi,
sorry for the slow reply. There currently is no inbuilt functionality in
Bro to do this. However this feels a bit like an oversight and is probably
something that should be added in the future.
Johanna
Sorry about that oversight. I just filed a merge request for this feature and it will be in Bro 2.6
https://bro-tracker.atlassian.net/browse/BIT-1887
.Seth