/zeek/hosom/file-extraction

[georgio]

Hello!
I am currently working on my first NDR solution and I choose zeek for this, I am wondering if this “zeek/hosom/file-extraction” module for file-extraction is considered safe since is not included on the official documentation. Thanks and have a nice one!

[Richard_Bejtlich]

@georgio

zeek/hosom/file-extraction

Some people do use it:

Extract Specific File Types (Not All Files)

Hello all, I am using version 5.0.7-0 Zeek-Lts. At the same time, multiple pcaps are processed in parallel. All files are extracted with the extension: …/policy/frameworks/files/extract-all-files.zeek How can I prevent the extraction of “Unknown” and “Archive” files that take a long time and slow down the processing of pcaps? I don’t want to extract such files in pcap. How can I get the remaining different types of files to be extracted when these types arrive and continue when they are no…