Hello,
I'm trying to use this function in my script:
function find_event(value: string) {
local url = fmt("%s/%s/ip-src",prefix, value);
local arg = fmt("--header \"Authorization: %s\"",auth);
local req = ActiveHTTP::Request($url=url, $addl_curl_args=arg);
when ( local resp = ActiveHTTP::request(req) )
{
print resp;
}
}
event Intel::match(s: Intel::Seen, items: set [Intel::Item]) {
find_event(s$indicator);
}
Prefix and auth are global.
Just sometimes it prints response. Most of times it prints
rm: cannot remove `/tmp/bro-activehttp-<id>_body': No such file or
directory
Can you tell me please what I'm doing wrong or why it is happenning ?
Thank you