[Bro] check rx and tx hosts for files

Johanna Amann johanna at icir.org
Fri Oct 14 06:31:08 PDT 2016

Hi Brian,

you should be able to just use the event file_over_new_connection, which
includes the connection record. With that, you don't have to loop over
complex data structures and can just use Site::is_local_addr.

This would probably look similar to:

event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
    if ( is_orig && Site::is_local_addr(c$id$orig_h) )
        	Files::add_analyzer(f, Files::ANALYZER_EXTRACT);

I hope this helps,

More information about the Bro mailing list