[Bro] Multiple Intel framework hits for same connection?
lists at g-clef.net
Tue Sep 30 13:59:35 PDT 2014
No worries. That's fixed it. I'm seeing hits for certs when I change to
Thanks for your help.
On 09/30/2014 04:46 PM, Seth Hall wrote:
> On Sep 30, 2014, at 4:39 PM, Aaron Gee-Clough <lists at g-clef.net>
>> If they did get implemented, then I'm not sure what I'm doing
>> wrong...I just can't get bro to fire for SSL cert hashes. I'm
>> running bro 2.3.1 (just updated today), if that makes any
> Sorry, that's my mistake. I never actually implemented a script that
> used CERT_HASH. Just make those FILE_HASH instead. That's more
> proper anyway now that certs are handled as files.
> -- Seth Hall International Computer Science Institute (Bro) because
> everyone has a network http://www.bro.org/
More information about the Bro