[Bro] Quick question
seth at icir.org
Fri Mar 22 13:56:50 PDT 2013
On Mar 22, 2013, at 4:47 PM, Aashish SHARMA <init.conf at gmail.com> wrote:
> ( A notice for binaries on the network is a subjective decision but I think it was not as bad an idea Seth. )
I'm saying the implementation was bad on my part. It just shouldn't be a notice. :)
> Off course, now with input framework we can feed bad md5s into bro realtime etc, but still post-processing of some nature in useful and needed.
The file analysis framework is going to affect all of your points and generally I think it will make all of them nicer and more consistent.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro