> You'll need both. Create a intel-conn-attempted.bro file next to your local.bro and include the code there. I guess this use case might be quite common. I would vote for adding a conn-attempted.bro to the seen scripts but require explicit loading. Jan