[Bro] postprocessing extracted files
Frank Meier
franky.meier.1 at gmx.de
Wed Apr 15 06:04:19 PDT 2015
Hi,
On Mi, Apr 15, 2015 at 2:17 , Seth Hall <seth at icir.org> wrote:
> You can handle the file_state_remove event. At that point,
> everything about the file is complete and it’s being flushed from
> memory.
>
> event file_state_remove(f: fa_file)
> {
> # Do what you need.
> }
Thanks! That was easy.
Franky
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150415/ff6e065b/attachment-0001.html
More information about the Bro
mailing list