Reading a table from an external file

Zeek
1

I recently saw something online about reading a table from an external file in a bro script. Now that I’m ready to do that, I can’t find any references or code examples. Can anyone provide some links?

Best Regards,

Earl Eiland,

Sr. Cyber Security Engineer,

Emerging Technologies, root9B,

San Antonio, Texas

2

It's the input framework: https://www.bro.org/sphinx/frameworks/input.html

Robin

3

This is what I remembered. Thanks, Robin.

Naturally, I can't follow the example. My table will have three fields, all of which are sets. How can I read in sets?

Earl

4

Take a look at the test in
testing/btest/scripts/base/frameworks/input/setseparator.bro, that
reads in a set, using '|' as the element separator. (If you don't set
that explicitly, it's comma instead.)

Btw, the test suite has a bunch of more tests for the input framework,
which can provide inspiration for more involved use cases that aren't
covered elsewhere.

Robin

5

Thanks, Robin.

I don't see the path you mention below on github. How do I find it?

Earl

6

Ignore my previous email. I found it.