[Bro] Quick question

Seth Hall seth at icir.org
Fri Mar 22 13:56:50 PDT 2013


On Mar 22, 2013, at 4:47 PM, Aashish SHARMA <init.conf at gmail.com> wrote:

> ( A notice for binaries on the network is a subjective decision but I think it was not as bad an idea Seth. )

I'm saying the implementation was bad on my part.  It just shouldn't be a notice. :)

> Off course, now with input framework we can feed bad md5s into bro realtime etc, but still post-processing of some nature in useful and needed.  


The file analysis framework is going to affect all of your points and generally I think it will make all of them nicer and more consistent.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/





More information about the Bro mailing list