[Bro] Looking up fa_file given FUID

Johanna Amann johanna at icir.org
Thu Dec 28 07:43:33 PST 2017


Hi,

sorry for the slow reply. There currently is no inbuilt functionality in
Bro to do this. However this feels a bit like an oversight and is probably
something that should be added in the future.

Johanna

On Thu, Oct 12, 2017 at 07:16:02PM +0000, Lamps, Jereme wrote:
> Hello,
> 
> I was just wondering if it was possible to lookup fa_file or Files::Info records given a FUID. I have been looking through the built in functions but have not seen anything.
> 
> Best,
> 
> Jereme Lamps

> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro



More information about the Bro mailing list