So in looking at xlsm/docm files I noticed this...where bro says: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet but the pcap says: application/vnd.ms-excel.sheet.macroenabled.12 Is there a way to fine tune this in bro? Identifying files flying around with macros would be wonderful...thank you.