[Zeek-Dev] Use zeek scripts only with the "manager" in a cluster configuration

Jon Siwek jsiwek at corelight.com
Wed Jun 10 09:28:13 PDT 2020


On Wed, Jun 10, 2020 at 8:14 AM Davide Robusto <daviderobusto at gmail.com> wrote:

> Is it possible to inhibit the use of code fragments for workers?
> Zeek scripts can only be used by Zeek's "manager" or "logger",
> so as to prevent "workers" from doing unwanted actions? If yes, is also possible to make "worker"
> able to use some code fragments instead of others ?

See if these examples help:
https://docs.zeek.org/en/current/frameworks/broker.html#cluster-framework-examples

This particular one shows 3 different way to conditionalize the
execution of code based on either the node type or a specific node's
name: https://docs.zeek.org/en/current/frameworks/broker.html#manager-sending-events-to-workers

- Jon


More information about the Zeek-Dev mailing list