[Bro] smb log add new field

Seth Hall seth at corelight.com
Thu Nov 2 06:15:00 PDT 2017



On 2 Nov 2017, at 5:25, ps sunu wrote:

> @load base/protocols/smb

This is the problem.  Because we chose to leave the SMB scripts out of 
the default base load in 2.5 (they'll be there for 2.6!) you need to 
load them first.  Replace the line you used above with this...

```bro
@load policy/protocols/smb
```

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20171102/e2595972/attachment.html 


More information about the Bro mailing list