[Bro-Dev] get_event_peer() with Broker

Seth Hall seth at icir.org
Tue Feb 2 08:58:31 PST 2016


> On Feb 2, 2016, at 11:54 AM, Robin Sommer <robin at icir.org> wrote:
> 
> I was thinking about that but do we really want to give up the ability
> to tell where some information is coming from? 

We can just include that information in the notices directly on the worker.  There is no reason it needs to be done on the manager.

I think that giving up that information is reasonable and we do it.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the bro-dev mailing list