[Bro] HTTP Post data

Matthias Vallentin vallentin at icir.org
Thu Mar 8 09:29:54 PST 2012


> Is there a way to write the data(body) of a HTTP Post request to the
> http.log? Or another log file?

Yes, that's possible. You would have to reassemble the data from the
body across the http_entity_* events. Here is an example of how one
could do it:

https://github.com/mavam/brospects/blob/master/bro/bodies.bro

    Matthias



More information about the Bro mailing list