[Zeek] known_*

[Palumbo Mauro]

Hi everybody,
   there are a number of scripts (known_services, known_hosts, known_certs) which are implemented both using a broker store and sending broker events. It is possible to switch from one mode to the other using the option use_service_store.
Is there any particular reason for this? Is one option more efficient than the other?

Thanks,
Mauro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20190730/77d33c39/attachment.html