[Bro] Does files.log generator recognize application/json file types?
seth at icir.org
Thu Apr 2 21:21:07 PDT 2015
> On Apr 1, 2015, at 9:52 AM, Tim Molter <tim.molter at gmail.com> wrote:
> Does `files.log` generator recognize application/json file types, and if
> not, what could I modify to get that to work? What does the generator
> key into to make the decision?
It does not. Unfortunately JSON detection would be pretty difficult and fraught with false positives. If you have a regex that you’d like to suggest for matching JSON I’m sure some people could try it and we could find out if it’s resilient enough.
With Bro 2.3+ you can write your own file signatures that you can load in to try and sniff file mime types.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro