[Bro] A little more confusion with Intel
jlay at slave-tothe-box.net
Fri Feb 2 14:08:35 PST 2018
Looks like the intel-seen-more may fix the problem..I'll test and report
On 2018-02-02 11:57, Vern Paxson wrote:
>> I think EFFECTIVE_DOMAIN is better and
>> it matches the function being called in the domain-tld package.
> FWIW, sometimes the term "registered domain" is used for this.
> Bro mailing list
> bro at bro-ids.org
More information about the Bro