[Bro] Looking up fa_file given FUID

Seth Hall seth at corelight.com
Wed Jan 10 10:54:25 PST 2018



On 12 Oct 2017, at 15:16, Lamps, Jereme wrote:

> I was just wondering if it was possible to lookup fa_file or 
> Files::Info records given a FUID. I have been looking through the 
> built in functions but have not seen anything.

Sorry about that oversight.  I just filed a merge request for this 
feature and it will be in Bro 2.6
	https://bro-tracker.atlassian.net/browse/BIT-1887

   .Seth

--
Seth Hall * Corelight, Inc * www.corelight.com


More information about the Bro mailing list