[Bro] CIF and Bro Integration
jonschipp at gmail.com
Wed Mar 26 19:37:28 PDT 2014
If you don't want to upgrade, you can replace that Bro.pm file with this
On Wed, Mar 26, 2014 at 9:08 PM, Tom OBrion <hammadog at gmail.com> wrote:
> Well in looking at the DOC on the BRO site. I must have a different
> version of CIF causing the BRO plugin to format my feed differently.
> On Wed, Mar 26, 2014 at 9:46 PM, Bernhard Amann <
> bernhard at icsi.berkeley.edu> wrote:
>> On Mar 26, 2014, at 6:14 PM, Jon Schipp <jonschipp at gmail.com> wrote:
>> > I'm not so certain anymore ;)
>> > It looks like you're right  that the mode is set to REREAD .
>> > Though, I'm pretty sure that I've read in the documentation that a
>> restart is required for the removal of items.
>> > Maybe that was a mistake. Oh well.
>> You are right about that. Even though reread supports the removal of
>> the current way in which it is used in the intelligence framework does
>> not seem to.
>> I have to ask Seth why that is the case - it should be easy to change
>> Bro mailing list
>> bro at bro-ids.org
> Tom O'Brion
> Twitter: @tobrion
> Skype: TomOBrion
> "Life is too short to spend time with people who suck the happy out of
> [image: View Tom OBrion's profile on LinkedIn]<http://www.linkedin.com/in/tomobrion>
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro