[Bro] Finer detail on mime types

James Lay jlay at slave-tothe-box.net
Fri Jul 7 13:11:39 PDT 2017

So in looking at xlsm/docm files I noticed this...where bro says:


but the pcap says:


Is there a way to fine tune this in bro?  Identifying files flying 
around with macros would be wonderful...thank you.

More information about the Bro mailing list