[Zeek-Dev] Use zeek scripts only with the "manager" in a cluster configuration
Jon Siwek
jsiwek at corelight.com
Wed Jun 10 09:28:13 PDT 2020
On Wed, Jun 10, 2020 at 8:14 AM Davide Robusto <daviderobusto at gmail.com> wrote:
> Is it possible to inhibit the use of code fragments for workers?
> Zeek scripts can only be used by Zeek's "manager" or "logger",
> so as to prevent "workers" from doing unwanted actions? If yes, is also possible to make "worker"
> able to use some code fragments instead of others ?
See if these examples help:
https://docs.zeek.org/en/current/frameworks/broker.html#cluster-framework-examples
This particular one shows 3 different way to conditionalize the
execution of code based on either the node type or a specific node's
name: https://docs.zeek.org/en/current/frameworks/broker.html#manager-sending-events-to-workers
- Jon
More information about the Zeek-Dev
mailing list