[Bro-Dev] Support for HTTP body extraction of originator
Siwek, Jonathan Luke
jsiwek at illinois.edu
Mon Apr 22 08:48:17 PDT 2013
On Apr 22, 2013, at 10:19 AM, Matthias Vallentin <vallentin at icir.org>
>> Do I need to add an 'is_orig' flag to at least the 'file_new' event?
> I don't know the internals of the FA framework, I just recall a record
> fa_file which appears to be what the Info record is to the logging
fa_file is more analogous to the connection record now.
> Could it make sense to put the directionality in there for
> more flexibility? Then users can access this information in any event.
Yeah, that might be fine. Do you have an opinion, Seth (I thought you did when we talked about the loss of directionality before) ?
More information about the bro-dev