Hello,
with Zeek 5.1 we’re planning on removing (without deprecation) scripts and analyzers related to Snort/Unified2 integration.
Concretely:
- the barnyard2 policy scripts
- the unified2 file analyzer and related policy scripts
The former employs brocolli for communicating with Zeek and so can’t have been working with any modern version of Zeek for quite a bit, the latter is assumed to have no users.
Please get in touch if you do have a use for this functionality.
Thanks,
Arne