[Bro] postprocessing extracted files

[Frank Meier]

Hi,

On Mi, Apr 15, 2015 at 2:17 , Seth Hall <seth at icir.org> wrote:

> You can handle the file_state_remove event.  At that point, 
> everything about the file is complete and it’s being flushed from 
> memory.
> 
> event file_state_remove(f: fa_file)
> 	{
> 	# Do what you need.
> 	}

Thanks! That was easy.

Franky
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150415/ff6e065b/attachment-0001.html